USN-7012-1: curl vulnerability
Published Sep 16, 2024
·Updated
Hiroki Kurosawa discovered that curl incorrectly handled certain OCSP responses. This could result in bad certificates not being checked properly, contrary to expectations.
Affected Software
22 affected componentsFixes available
All of the following
ubuntu/curl<8.5.0-2ubuntu10.4
8.5.0-2ubuntu10.4
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libcurl3t64-gnutls<8.5.0-2ubuntu10.4
8.5.0-2ubuntu10.4
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libcurl4t64<8.5.0-2ubuntu10.4
8.5.0-2ubuntu10.4
Ubuntu Ubuntu=24.04
All of the following
ubuntu/curl<7.81.0-1ubuntu1.18
7.81.0-1ubuntu1.18
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libcurl3-gnutls<7.81.0-1ubuntu1.18
7.81.0-1ubuntu1.18
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libcurl3-nss<7.81.0-1ubuntu1.18
7.81.0-1ubuntu1.18
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libcurl4<7.81.0-1ubuntu1.18
7.81.0-1ubuntu1.18
Ubuntu Ubuntu=22.04
All of the following
ubuntu/curl<7.68.0-1ubuntu2.24
7.68.0-1ubuntu2.24
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libcurl3-gnutls<7.68.0-1ubuntu2.24
7.68.0-1ubuntu2.24
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libcurl3-nss<7.68.0-1ubuntu2.24
7.68.0-1ubuntu2.24
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libcurl4<7.68.0-1ubuntu2.24
7.68.0-1ubuntu2.24
Ubuntu Ubuntu=20.04
Event History
Sep 16, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-7012-1?
The severity of USN-7012-1 is classified as high due to the risk of improper certificate validation.
2
How do I fix USN-7012-1?
To fix USN-7012-1, upgrade to the specified version of curl or libcurl for your Ubuntu version.
3
What issues does USN-7012-1 address?
USN-7012-1 addresses a vulnerability in curl related to incorrect handling of certain OCSP responses.
4
Which versions are affected by USN-7012-1?
USN-7012-1 affects multiple versions of curl and libcurl on Ubuntu 20.04, 22.04, and 24.04.
5
Who discovered the vulnerability in USN-7012-1?
The vulnerability in USN-7012-1 was discovered by researcher Hiroki Kurosawa.