[SECURITY] [DLA 3613-1] curl security update

2023-10-1111:49:02

lists.debian.org

update

debian

cookie injection

cve-2023-28321

cve-2023-38546

debian 10 buster

security

curl

hostname matching

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

8.7

Confidence

Low

EPSS

0.002

Percentile

56.7%

JSON

Debian LTS Advisory DLA-3613-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
October 11, 2023 https://wiki.debian.org/LTS

Package : curl
Version : 7.64.0-4+deb10u7
CVE ID : CVE-2023-28321 CVE-2023-38546

Two security issues were found in Curl, an easy-to-use client-side URL
transfer library and command line tool.

CVE-2023-28321

Hiroki Kurosawa found that curl could mismatch hostnames with
wildcards when using its own name matching function.

CVE-2023-38546

It was discovered that under some circumstances libcurl was
susceptible to cookie injection.

For Debian 10 buster, these problems have been fixed in version
7.64.0-4+deb10u7.

We recommend that you upgrade your curl packages.

For the detailed security status of curl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/curl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11amd64curl< 7.74.0-1.3+deb11u10curl_7.74.0-1.3+deb11u10_amd64.deb
Debian12ppc64ellibcurl3-nss< 7.88.1-10+deb12u4libcurl3-nss_7.88.1-10+deb12u4_ppc64el.deb
Debian12armhflibcurl4-gnutls-dev< 7.88.1-10+deb12u4libcurl4-gnutls-dev_7.88.1-10+deb12u4_armhf.deb
Debian11arm64libcurl4-openssl-dev< 7.74.0-1.3+deb11u10libcurl4-openssl-dev_7.74.0-1.3+deb11u10_arm64.deb
Debian11s390xlibcurl3-nss-dbgsym< 7.74.0-1.3+deb11u10libcurl3-nss-dbgsym_7.74.0-1.3+deb11u10_s390x.deb
Debian11mips64ellibcurl4-openssl-dev< 7.74.0-1.3+deb11u10libcurl4-openssl-dev_7.74.0-1.3+deb11u10_mips64el.deb
Debian11armellibcurl4-gnutls-dev< 7.74.0-1.3+deb11u9libcurl4-gnutls-dev_7.74.0-1.3+deb11u9_armel.deb
Debian11armellibcurl4< 7.74.0-1.3+deb11u9libcurl4_7.74.0-1.3+deb11u9_armel.deb
Debian11amd64libcurl4-gnutls-dev< 7.74.0-1.3+deb11u10libcurl4-gnutls-dev_7.74.0-1.3+deb11u10_amd64.deb
Debian10arm64libcurl4< 7.64.0-4+deb10u7libcurl4_7.64.0-4+deb10u7_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	amd64	curl	< 7.74.0-1.3+deb11u10	curl_7.74.0-1.3+deb11u10_amd64.deb
Debian	12	ppc64el	libcurl3-nss	< 7.88.1-10+deb12u4	libcurl3-nss_7.88.1-10+deb12u4_ppc64el.deb
Debian	12	armhf	libcurl4-gnutls-dev	< 7.88.1-10+deb12u4	libcurl4-gnutls-dev_7.88.1-10+deb12u4_armhf.deb
Debian	11	arm64	libcurl4-openssl-dev	< 7.74.0-1.3+deb11u10	libcurl4-openssl-dev_7.74.0-1.3+deb11u10_arm64.deb
Debian	11	s390x	libcurl3-nss-dbgsym	< 7.74.0-1.3+deb11u10	libcurl3-nss-dbgsym_7.74.0-1.3+deb11u10_s390x.deb
Debian	11	mips64el	libcurl4-openssl-dev	< 7.74.0-1.3+deb11u10	libcurl4-openssl-dev_7.74.0-1.3+deb11u10_mips64el.deb
Debian	11	armel	libcurl4-gnutls-dev	< 7.74.0-1.3+deb11u9	libcurl4-gnutls-dev_7.74.0-1.3+deb11u9_armel.deb
Debian	11	armel	libcurl4	< 7.74.0-1.3+deb11u9	libcurl4_7.74.0-1.3+deb11u9_armel.deb
Debian	11	amd64	libcurl4-gnutls-dev	< 7.74.0-1.3+deb11u10	libcurl4-gnutls-dev_7.74.0-1.3+deb11u10_amd64.deb
Debian	10	arm64	libcurl4	< 7.64.0-4+deb10u7	libcurl4_7.64.0-4+deb10u7_arm64.deb