You are here
Home > Preporuke > Sigurnosni nedostatak programskog paketa curl

Sigurnosni nedostatak programskog paketa curl

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LRH

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: curl security update
Advisory ID: RHSA-2020:3916-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3916
Issue date: 2020-09-29
CVE Names: CVE-2019-5482
=====================================================================

1. Summary:

An update for curl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) – x86_64
Red Hat Enterprise Linux Client Optional (v. 7) – x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) – x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) – x86_64
Red Hat Enterprise Linux Server (v. 7) – ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) – x86_64

3. Description:

The curl packages provide the libcurl library and the curl utility for
downloading files from servers using various protocols, including HTTP,
FTP, and LDAP.

Security Fix(es):

* curl: heap buffer overflow in function tftp_receive_packet()
(CVE-2019-5482)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.9 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1749652 – CVE-2019-5482 curl: heap buffer overflow in function tftp_receive_packet()
1836773 – POST followed by a GET with large headers on the same connection leads to a NULL dereference

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
curl-7.29.0-59.el7.src.rpm

x86_64:
curl-7.29.0-59.el7.x86_64.rpm
curl-debuginfo-7.29.0-59.el7.i686.rpm
curl-debuginfo-7.29.0-59.el7.x86_64.rpm
libcurl-7.29.0-59.el7.i686.rpm
libcurl-7.29.0-59.el7.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:
curl-debuginfo-7.29.0-59.el7.i686.rpm
curl-debuginfo-7.29.0-59.el7.x86_64.rpm
libcurl-devel-7.29.0-59.el7.i686.rpm
libcurl-devel-7.29.0-59.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
curl-7.29.0-59.el7.src.rpm

x86_64:
curl-7.29.0-59.el7.x86_64.rpm
curl-debuginfo-7.29.0-59.el7.i686.rpm
curl-debuginfo-7.29.0-59.el7.x86_64.rpm
libcurl-7.29.0-59.el7.i686.rpm
libcurl-7.29.0-59.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

x86_64:
curl-debuginfo-7.29.0-59.el7.i686.rpm
curl-debuginfo-7.29.0-59.el7.x86_64.rpm
libcurl-devel-7.29.0-59.el7.i686.rpm
libcurl-devel-7.29.0-59.el7.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
curl-7.29.0-59.el7.src.rpm

ppc64:
curl-7.29.0-59.el7.ppc64.rpm
curl-debuginfo-7.29.0-59.el7.ppc.rpm
curl-debuginfo-7.29.0-59.el7.ppc64.rpm
libcurl-7.29.0-59.el7.ppc.rpm
libcurl-7.29.0-59.el7.ppc64.rpm
libcurl-devel-7.29.0-59.el7.ppc.rpm
libcurl-devel-7.29.0-59.el7.ppc64.rpm

ppc64le:
curl-7.29.0-59.el7.ppc64le.rpm
curl-debuginfo-7.29.0-59.el7.ppc64le.rpm
libcurl-7.29.0-59.el7.ppc64le.rpm
libcurl-devel-7.29.0-59.el7.ppc64le.rpm

s390x:
curl-7.29.0-59.el7.s390x.rpm
curl-debuginfo-7.29.0-59.el7.s390.rpm
curl-debuginfo-7.29.0-59.el7.s390x.rpm
libcurl-7.29.0-59.el7.s390.rpm
libcurl-7.29.0-59.el7.s390x.rpm
libcurl-devel-7.29.0-59.el7.s390.rpm
libcurl-devel-7.29.0-59.el7.s390x.rpm

x86_64:
curl-7.29.0-59.el7.x86_64.rpm
curl-debuginfo-7.29.0-59.el7.i686.rpm
curl-debuginfo-7.29.0-59.el7.x86_64.rpm
libcurl-7.29.0-59.el7.i686.rpm
libcurl-7.29.0-59.el7.x86_64.rpm
libcurl-devel-7.29.0-59.el7.i686.rpm
libcurl-devel-7.29.0-59.el7.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
curl-7.29.0-59.el7.src.rpm

x86_64:
curl-7.29.0-59.el7.x86_64.rpm
curl-debuginfo-7.29.0-59.el7.i686.rpm
curl-debuginfo-7.29.0-59.el7.x86_64.rpm
libcurl-7.29.0-59.el7.i686.rpm
libcurl-7.29.0-59.el7.x86_64.rpm
libcurl-devel-7.29.0-59.el7.i686.rpm
libcurl-devel-7.29.0-59.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-5482
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBX3OiztzjgjWX9erEAQh3uBAAgJl/JGi14Y2XZos19DXgHE6+9W7hrbjy
96TCoCkjeFrZ7B/H8H8gUfJ2lOo4cSKi6UkFietK3OmX+oENkUZZmhqntTov4Dcr
csZvfvvJYLvzWqxofFLAbE1HR3qMVtWBBphGBJMrTP3AygtDgfglkkf4OSrIU+PE
BYEfGUuXQUrXE9P/XZ6Ft5bVX/gi4osQLYVU4biEIvAAoEbynDZi60XTkzlKndFy
uGIvftzPK3H7SyuDwLOON74BzPKUiE0NPBTf68L5rbmCeUY5wDMeC4nZdPmexr9C
NW7eOlPt0eZbhaJUbxIUZihSB1REsXKtIycgWTSVpZAXAyQGquMDVSbRssPAmDgp
/9+QCQT3bCnFXKkbvUiQyDo7nmWTz0ji9du8x47i6enNOdXxUVnUy+LHUsAecY+a
bBUJ6gGllQOC/aEYyo6jhZo9hmc80rYRdUXh3aFHVZPPAqvRcGIV+mH20ojAuJCD
g0F6CpJRqgGQgYuunzeXdqV9rZG49Jg7boFKTRK2jeVIoUjRiXTdRfVCZIl8bGuv
scUUYmnojPHGmSBY/0TgyR73OfFvwMg0BWuPTtmCi7PtYxepx9dCM195qFZoD5O7
4lUvxnGdHNF2O6bkHCmXLFvgpFKH5BRu0LP+W6CahwHz7zZBWZFF3UGtjk1+h58C
Q1XQB8YzuaI=
=LxMe
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

AutorBruno Varga
Cert idNCERT-REF-2020-09-0001-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
IzvorAdobe
Top
More in Preporuke
Sigurnosni nedostaci programske biblioteke libtiff

Otkriveni su sigurnosni nedostaci programske biblioteke libtiff za operacijski sustav RHEL. Otkriveni nedostaci potencijalnim napadačima omogućuju izazivanje DoS stanja ili...

Close