curl-7.61.1-22.el8.3
エラータID: AXSA:2022-3782:01
リリース日:
2022/09/01 Thursday - 07:10
題名:
curl-7.61.1-22.el8.3
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- curl には、接続時に設定された認証情報と同じもので
認証されていることを確認せずに OAUTH2 接続を再利用できる
問題があるため、攻撃者による認証の回避を可能とする脆弱性が
存在します。(CVE-2022-22576)
- curl には、保護された HTTP(S) 通信のリダイレクト時の認証
情報の保護に問題があるため、攻撃者により認証情報が抽出され、
他のプロトコルもしくはポート番号を利用するサービスへの認証
情報の漏洩を可能とする脆弱性が存在します。(CVE-2022-27774)
- curl には、認証情報の保護に問題があるため、同じホスト上の
他のポート番号のアプリケーションへHTTP リダイレクトの認証
情報や Cookie ヘッダ情報の漏洩を可能とする脆弱性が存在します。
(CVE-2022-27776)
- libcurl には、TLS や SSH 接続の一部の設定が変更された場合に
本来再利用できない接続を再利用する問題があるため、攻撃者による
認証の回避を可能とする脆弱性が存在します(CVE-2022-27782)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2022-22576
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).
CVE-2022-27774
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
CVE-2022-27776
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
CVE-2022-27782
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.
追加情報:
N/A
ダウンロード:
SRPMS
- curl-7.61.1-22.el8.3.src.rpm
MD5: 2bec61821194c44c1c0d64a45354abeb
SHA-256: 12238d37a44e0b9a0500e42a4491dea15c04f888335bc7ccdca44ada672dcc23
Size: 2.42 MB
Asianux Server 8 for x86_64
- curl-7.61.1-22.el8.3.x86_64.rpm
MD5: 4793c432ae602d1ee36dbc29df11e602
SHA-256: 7e631f7596897d178532c7c20deaf42929b378980f9425b5492fff8abb73f4a8
Size: 350.89 kB - libcurl-7.61.1-22.el8.3.x86_64.rpm
MD5: c6163be9055d05543b828fab34b18838
SHA-256: 39b8f0a215f92cb57d69cf771aa9b3a1fecd363fa995f6a44ec3133f50b23369
Size: 300.59 kB - libcurl-devel-7.61.1-22.el8.3.x86_64.rpm
MD5: e44083746884cb5e31ddecce7292a347
SHA-256: 16af1e4db08757eb2cfc6accb60f8c174bbbd85e1a666a9a4621af02f4e28bb1
Size: 833.05 kB - libcurl-minimal-7.61.1-22.el8.3.x86_64.rpm
MD5: 09bc62e5223a5474ef44080003fc14fe
SHA-256: 53c8be1c02485f1a55d62e3917f55f47d92a648c078c3f2eeea0c9347461ba8d
Size: 287.07 kB - libcurl-7.61.1-22.el8.3.i686.rpm
MD5: e0adf187a0b496f44496fbf32ff65f71
SHA-256: cbed52da5309b0cf47ba18f4ba3d01e9172aba3aae6eee6d16951f34760a642b
Size: 328.22 kB - libcurl-devel-7.61.1-22.el8.3.i686.rpm
MD5: e617ecb9870ecba9787f8fb3c3ade826
SHA-256: 2c778f87f52e1332104ce970c57620ed441b0cca7e0629f309be801e4d80f7c9
Size: 833.10 kB - libcurl-minimal-7.61.1-22.el8.3.i686.rpm
MD5: 3a4cd6f76af0a0111f1ebd4b6d7eea76
SHA-256: 2043050cd70c377e225b86b1d949b285d53c47386236fab682c40cb4573b5f46
Size: 313.78 kB
English