curl-7.76.1-14.el9.5.ML.1
エラータID: AXSA:2022-4407:05
リリース日:
2022/12/13 Tuesday - 07:26
題名:
curl-7.76.1-14.el9.5.ML.1
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- curl には、サーバーの応答を複数回の異なる HTTP 圧縮アルゴ
リズムで圧縮可能であり、それを展開する際の上限数が無制限という
問題があるため、ヒープメモリの枯渇を引き起こす可能性のある
脆弱性があります。(CVE-2022-32206)
- curl には、Cookie、alt-svc、および hsts データファイルを
保存する処理においてファイルのアクセス権限を拡大してしまう問題が
あるため、リモートの攻撃者により、情報漏洩を可能とする脆弱性が
存在します。(CVE-2022-32207)
- curl には、krb5 で保護された FTP 転送を行う際、メッセージ検証の
失敗を不正に処理し、中間者攻撃が可能になる脆弱性があります。
(CVE-2022-32208)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2022-32206
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
CVE-2022-32207
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
CVE-2022-32208
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
追加情報:
N/A
ダウンロード:
SRPMS
- curl-7.76.1-14.el9.5.ML.1.src.rpm
MD5: 86061d503892160e65feaf4019a879c4
SHA-256: b9938bc3fcdde086036e4ce01dace5b56fbf8cacc31dd1048c63da26c7beb6f4
Size: 2.39 MB
Asianux Server 9 for x86_64
- curl-7.76.1-14.el9.5.ML.1.x86_64.rpm
MD5: 94a4bd53fd2a87e7f95abb3145906d29
SHA-256: 055f29de1b79ee478ee33daf5829f032b53b3a9ad2c6bafd4ad0d32433a09a23
Size: 294.66 kB - curl-minimal-7.76.1-14.el9.5.ML.1.x86_64.rpm
MD5: 6804b657cd483bc1eac1e6285085d3b2
SHA-256: 0edef1d9924e22a8afa30db07d0514a937d46abda70df4e0f01040b688dd4346
Size: 128.19 kB - libcurl-7.76.1-14.el9.5.ML.1.x86_64.rpm
MD5: b776d95e15bef0a9efcf4ff59a369045
SHA-256: 388f9dd1fd084767a9e902eb3d1de854e0e077b06888d17cab2c6715656e4de9
Size: 284.27 kB - libcurl-devel-7.76.1-14.el9.5.ML.1.x86_64.rpm
MD5: a473db2e668011c889a457a6bf2616f3
SHA-256: ac1bdd77f1f58e03dbf37377fe39964de764df2b04cf6c7b80d1d87fff87a0f0
Size: 849.79 kB - libcurl-minimal-7.76.1-14.el9.5.ML.1.x86_64.rpm
MD5: eb867b923bf476ef61da3c5762314106
SHA-256: f58eb03d86bb84e6c62117db8e4a8ef27a91a9328a849e49e26b9cf4d8e0fb4f
Size: 225.67 kB - libcurl-7.76.1-14.el9.5.ML.1.i686.rpm
MD5: 0cee8b8a521812c281307ac46e11b328
SHA-256: c5c39953029a124ee1fec6925d4f425594d255efab6b3e4def3781d4139b8ea6
Size: 311.31 kB - libcurl-devel-7.76.1-14.el9.5.ML.1.i686.rpm
MD5: 555f5f7ed50d0af751885b419ed67ada
SHA-256: c6cc13a5dacd8a0fe28d00496e3bd76c8bf7f759992d654fe9c4a92ed5d7903f
Size: 849.83 kB - libcurl-minimal-7.76.1-14.el9.5.ML.1.i686.rpm
MD5: 8473914f10e93b79f8610985c4b4e4d4
SHA-256: 1c87ed935184318e8da2ce559820433fa7fb0b2f888a445fa0d6fcca6d6fb8dc
Size: 246.18 kB
English