USN-7162-1: curl vulnerability
Published Dec 16, 2024
·Updated
Harry Sintonen discovered that curl incorrectly handled credentials from .netrc files when following HTTP redirects. In certain configurations, the password for the first host could be leaked to the followed-to host, contrary to expectations.
Affected Software
28 affected componentsFixes available
All of the following
ubuntu/curl<8.9.1-2ubuntu2.2
8.9.1-2ubuntu2.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libcurl3t64-gnutls<8.9.1-2ubuntu2.2
8.9.1-2ubuntu2.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libcurl4t64<8.9.1-2ubuntu2.2
8.9.1-2ubuntu2.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/curl<8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.6
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libcurl3t64-gnutls<8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.6
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libcurl4t64<8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.6
Ubuntu Ubuntu=24.04
All of the following
ubuntu/curl<7.81.0-1ubuntu1.20
7.81.0-1ubuntu1.20
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libcurl3-gnutls<7.81.0-1ubuntu1.20
7.81.0-1ubuntu1.20
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libcurl3-nss<7.81.0-1ubuntu1.20
7.81.0-1ubuntu1.20
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libcurl4<7.81.0-1ubuntu1.20
7.81.0-1ubuntu1.20
Ubuntu Ubuntu=22.04
All of the following
ubuntu/curl<7.68.0-1ubuntu2.25
7.68.0-1ubuntu2.25
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libcurl3-gnutls<7.68.0-1ubuntu2.25
7.68.0-1ubuntu2.25
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libcurl3-nss<7.68.0-1ubuntu2.25
7.68.0-1ubuntu2.25
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libcurl4<7.68.0-1ubuntu2.25
7.68.0-1ubuntu2.25
Ubuntu Ubuntu=20.04
Event History
Dec 16, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-7162-1?
The severity of USN-7162-1 is considered critical due to potential credential leaks.
2
How do I fix USN-7162-1?
To fix USN-7162-1, update curl and libcurl packages to the specified remedies for your Ubuntu version.
3
Which versions of curl are affected by USN-7162-1?
Affected versions include curl versions prior to 8.9.1-2ubuntu2.2, 8.5.0-2ubuntu10.6, and 7.81.0-1ubuntu1.20.
4
What systems are impacted by USN-7162-1?
All supported versions of Ubuntu that include affected versions of curl are impacted by USN-7162-1.
5
What command do I run to update curl for USN-7162-1?
You can update curl by running the command 'sudo apt update && sudo apt upgrade curl'.