Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux curl could mis-handle cookies or crash
published 3 years ago
Summary
The curl and libcurl packages on AlmaLinux can incorrectly process special characters in cookies and may crash when a proxy refuses a connection. This could let an attacker cause the program to stop working or potentially run unwanted code. Install the latest AlmaLinux curl update as soon as possible to fix the issue.
What to do
- Update almalinux curl to version 7.61.1-30.el8.
- Update almalinux libcurl to version 7.61.1-30.el8.
- Update almalinux libcurl-devel to version 7.61.1-30.el8.
- Update almalinux libcurl-minimal to version 7.61.1-30.el8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | curl |
< 7.61.1-30.el8 Fix: upgrade to 7.61.1-30.el8
|
| AlmaLinux:8 | almalinux | libcurl |
< 7.61.1-30.el8 Fix: upgrade to 7.61.1-30.el8
|
| AlmaLinux:8 | almalinux | libcurl-devel |
< 7.61.1-30.el8 Fix: upgrade to 7.61.1-30.el8
|
| AlmaLinux:8 | almalinux | libcurl-minimal |
< 7.61.1-30.el8 Fix: upgrade to 7.61.1-30.el8
|
Original advisory text
Low: curl security and bug fix update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
* curl: Incorrect handling of control code characters in cookies (CVE-2022-35252)
* curl: Use-after-free triggered by an HTTP proxy deny response (CVE-2022-43552)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Security Fix(es):
* curl: Incorrect handling of control code characters in cookies (CVE-2022-35252)
* curl: Use-after-free triggered by an HTTP proxy deny response (CVE-2022-43552)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
References
- https://access.redhat.com/errata/RHSA-2023:2963 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-35252 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-43552 Third Party Advisory
- https://bugzilla.redhat.com/2120718 Third Party Advisory
- https://bugzilla.redhat.com/2152652 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2023-2963.html Vendor Advisory
Timeline
Published16 May 2023
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2023:2963 · OSV
Track software like this
Free during beta