rpm package
suse/curl&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2
pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-28322 | — | < 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 | May 26, 2023 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was | ||
| CVE-2023-28321 | — | < 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 | May 26, 2023 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provi | ||
| CVE-2023-28320 | — | < 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 | May 26, 2023 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` an | ||
| CVE-2022-32221 | — | < 7.66.0-150200.4.42.1 | 7.66.0-150200.4.42.1 | Dec 5, 2022 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This f | ||
| CVE-2022-32208 | — | < 7.66.0-150200.4.36.1 | 7.66.0-150200.4.36.1 | Jul 7, 2022 | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. | ||
| CVE-2022-32206 | — | < 7.66.0-150200.4.36.1 | 7.66.0-150200.4.36.1 | Jul 7, 2022 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to ins | ||
| CVE-2022-27782 | Hig | 7.5 | < 7.66.0-150200.4.33.1 | 7.66.0-150200.4.33.1 | Jun 2, 2022 | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, s | |
| CVE-2022-27781 | Hig | 7.5 | < 7.66.0-150200.4.33.1 | 7.66.0-150200.4.33.1 | Jun 2, 2022 | libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve |
- CVE-2023-28322May 26, 2023affected < 7.66.0-150200.4.57.1fixed 7.66.0-150200.4.57.1
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was
- CVE-2023-28321May 26, 2023affected < 7.66.0-150200.4.57.1fixed 7.66.0-150200.4.57.1
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provi
- CVE-2023-28320May 26, 2023affected < 7.66.0-150200.4.57.1fixed 7.66.0-150200.4.57.1
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` an
- CVE-2022-32221Dec 5, 2022affected < 7.66.0-150200.4.42.1fixed 7.66.0-150200.4.42.1
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This f
- CVE-2022-32208Jul 7, 2022affected < 7.66.0-150200.4.36.1fixed 7.66.0-150200.4.36.1
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
- CVE-2022-32206Jul 7, 2022affected < 7.66.0-150200.4.36.1fixed 7.66.0-150200.4.36.1
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to ins
- affected < 7.66.0-150200.4.33.1fixed 7.66.0-150200.4.33.1
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, s
- affected < 7.66.0-150200.4.33.1fixed 7.66.0-150200.4.33.1
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve