Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

curl on Red Hat could let attackers run code

published 2 years ago

Summary

The curl utility and its development files on Red Hat systems have a flaw that could let a remote attacker execute code when processing specially crafted web data. This could lead to unauthorized control of the affected server. Apply the Red Hat security update for curl and related packages as soon as possible to close the gap.

What to do

Update redhat curl-debuginfo to version 0:7.76.1-14.el9_0.6.
Update redhat curl-debugsource to version 0:7.76.1-14.el9_0.6.
Update redhat curl-minimal-debuginfo to version 0:7.76.1-14.el9_0.6.
Update redhat libcurl-debuginfo to version 0:7.76.1-14.el9_0.6.
Update redhat libcurl-devel to version 0:7.76.1-14.el9_0.6.
Update redhat libcurl-minimal-debuginfo to version 0:7.76.1-14.el9_0.6.
Update redhat curl to version 0:7.76.1-14.el9_0.6.
Update redhat curl-minimal to version 0:7.76.1-14.el9_0.6.
Update redhat libcurl to version 0:7.76.1-14.el9_0.6.
Update redhat libcurl-minimal to version 0:7.76.1-14.el9_0.6.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:9.0::appstream	redhat	curl-debuginfo	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::appstream	redhat	curl-debugsource	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::appstream	redhat	curl-minimal-debuginfo	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::appstream	redhat	libcurl-debuginfo	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::appstream	redhat	libcurl-devel	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::appstream	redhat	libcurl-minimal-debuginfo	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::baseos	redhat	curl	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::baseos	redhat	curl-debuginfo	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::baseos	redhat	curl-debugsource	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::baseos	redhat	curl-minimal	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::baseos	redhat	curl-minimal-debuginfo	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::baseos	redhat	libcurl	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::baseos	redhat	libcurl-debuginfo	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::baseos	redhat	libcurl-minimal	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6
Red Hat:rhel_eus:9.0::baseos	redhat	libcurl-minimal-debuginfo	< 0:7.76.1-14.el9_0.6 Fix: upgrade to 0:7.76.1-14.el9_0.6

Original advisory text

Red Hat Security Advisory: curl security update

References

https://access.redhat.com/errata/RHSA-2023:4139 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2135411 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2167815 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4139.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-32221 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-32221 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-32221 Vendor Advisory
https://curl.se/docs/CVE-2022-32221.html Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-23916 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-23916 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-23916 Vendor Advisory
https://curl.se/docs/CVE-2023-23916.html Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Timeline

Published13 Sep 2024

Updated23 Sep 2026

First seen23 Sep 2026

Sources

RHSA-2023:4139 · OSV

Track software like this

Free during beta