What is the severity of RHSA-2021:3903?

The severity of RHSA-2021:3903 is classified as moderate.

How do I fix RHSA-2021:3903?

To fix RHSA-2021:3903, update the affected curl and libcurl packages to version 7.61.1-12.el8_2.3 or later.

Which packages are affected by RHSA-2021:3903?

Affected packages include curl, libcurl, curl-debuginfo, libcurl-debuginfo, and their respective debug sources.

What vulnerability is addressed in RHSA-2021:3903?

RHSA-2021:3903 addresses a vulnerability related to content not matching the hash in Metalink (CVE-2021-22922).

Is RHSA-2021:3903 applicable to all versions of curl?

No, RHSA-2021:3903 specifically applies to curl versions prior to 7.61.1-12.el8_2.3.

Vulnerability/
RHSA-2021:3903

19/10/2021

RHSA-2021:3903: Moderate: curl security update

First published: Tue Oct 19 2021(Updated: )

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.<br>Security Fix(es):<br><li> curl: Content not matching hash in Metalink is not being discarded (CVE-2021-22922)</li> <li> curl: Metalink download sends credentials (CVE-2021-22923)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software	Affected Version	How to fix
redhat/curl	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl-debugsource	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl-debugsource	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl-minimal-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl-minimal-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-devel	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-devel	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-minimal	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-minimal	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-minimal-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-minimal-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl-debugsource	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl-minimal-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-devel	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-minimal	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/libcurl-minimal-debuginfo	<7.61.1-12.el8_2.3	7.61.1-12.el8_2.3
redhat/curl	<7.61.1-12.el8_2.3.aa	7.61.1-12.el8_2.3.aa
redhat/curl-debuginfo	<7.61.1-12.el8_2.3.aa	7.61.1-12.el8_2.3.aa
redhat/curl-debugsource	<7.61.1-12.el8_2.3.aa	7.61.1-12.el8_2.3.aa
redhat/curl-minimal-debuginfo	<7.61.1-12.el8_2.3.aa	7.61.1-12.el8_2.3.aa
redhat/libcurl	<7.61.1-12.el8_2.3.aa	7.61.1-12.el8_2.3.aa
redhat/libcurl-debuginfo	<7.61.1-12.el8_2.3.aa	7.61.1-12.el8_2.3.aa
redhat/libcurl-devel	<7.61.1-12.el8_2.3.aa	7.61.1-12.el8_2.3.aa
redhat/libcurl-minimal	<7.61.1-12.el8_2.3.aa	7.61.1-12.el8_2.3.aa
redhat/libcurl-minimal-debuginfo	<7.61.1-12.el8_2.3.aa	7.61.1-12.el8_2.3.aa

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of RHSA-2021:3903?
The severity of RHSA-2021:3903 is classified as moderate.
How do I fix RHSA-2021:3903?
To fix RHSA-2021:3903, update the affected curl and libcurl packages to version 7.61.1-12.el8_2.3 or later.
Which packages are affected by RHSA-2021:3903?
Affected packages include curl, libcurl, curl-debuginfo, libcurl-debuginfo, and their respective debug sources.
What vulnerability is addressed in RHSA-2021:3903?
RHSA-2021:3903 addresses a vulnerability related to content not matching the hash in Metalink (CVE-2021-22922).
Is RHSA-2021:3903 applicable to all versions of curl?
No, RHSA-2021:3903 specifically applies to curl versions prior to 7.61.1-12.el8_2.3.

agent/references
agent/severity
agent/type
agent/first-publish-date
agent/softwarecombine
agent/last-modified-date
collector/redhat-errata
source/Red Hat
anchor-id/RHSA-2021:3903
agent/software-canonical-lookup
agent/title
agent/remedy
agent/description
agent/event
agent/trending
agent/tags
agent/source
package-manager/redhat