UbuntuUpdates.org

Package "libcurl3-nss"

Name: libcurl3-nss

Description:

easy-to-use client-side URL transfer library (NSS flavour)

Latest version: 7.68.0-1ubuntu2.24
Release: focal (20.04)
Level: updates
Repository: main
Head package: curl
Homepage: http://curl.haxx.se

Links


Download "libcurl3-nss"


Other versions of "libcurl3-nss" in Focal

Repository Area Version
base main 7.68.0-1ubuntu2
security main 7.68.0-1ubuntu2.24

Changelog

Version: 7.68.0-1ubuntu2.19 2023-07-19 15:07:08 UTC

  curl (7.68.0-1ubuntu2.19) focal-security; urgency=medium

  * SECURITY UPDATE: improper certificate validation vulnerability
    - debian/patches/CVE-2023-28321.patch: fix host name wildcard checking
      in lib/hostcheck.c, tests/data/test1397, tests/unit/unit1397.c.
    - CVE-2023-28321
  * SECURITY UPDATE: information disclosure vulnerability
    - debian/patches/CVE-2023-28322.patch: unify the upload/method handling
      in lib/curl_rtmp.c, lib/file.c, lib/ftp.c, lib/http.c, lib/imap.c,
      lib/rtsp.c, lib/setopt.c, lib/smb.c, lib/smtp.c, lib/tftp.c,
      lib/transfer.c, lib/urldata.h, lib/vssh/libssh.c, lib/vssh/libssh2.c.
    - CVE-2023-28322

 -- Marc Deslauriers <email address hidden> Mon, 17 Jul 2023 10:44:42 -0400

Source diff to previous version
CVE-2023-28321 An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject
CVE-2023-28322 An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOP

Version: 7.68.0-1ubuntu2.18 2023-03-20 15:07:31 UTC

  curl (7.68.0-1ubuntu2.18) focal-security; urgency=medium

  * SECURITY UPDATE: TELNET option IAC injection
    - debian/patches/CVE-2023-27533.patch: only accept option arguments in
      ascii in lib/telnet.c.
    - CVE-2023-27533
  * SECURITY UPDATE: SFTP path ~ resolving discrepancy
    - debian/patches/CVE-2023-27534-pre1.patch: do not add '/' if homedir
      ends with one in lib/curl_path.c.
    - debian/patches/CVE-2023-27534.patch: properly handle tilde character
      in lib/curl_path.c.
    - CVE-2023-27534
  * SECURITY UPDATE: FTP too eager connection reuse
    - debian/patches/CVE-2023-27535-pre1.patch: add and use Curl_timestrcmp
      in lib/netrc.c, lib/strcase.c, lib/strcase.h, lib/url.c,
      lib/vauth/digest_sspi.c, lib/vtls/vtls.c.
    - debian/patches/CVE-2023-27535.patch: add more conditions for
      connection reuse in lib/ftp.c, lib/ftp.h, lib/url.c, lib/urldata.h.
    - CVE-2023-27535
  * SECURITY UPDATE: GSS delegation too eager connection re-use
    - debian/patches/CVE-2023-27536.patch: only reuse connections with same
      GSS delegation in lib/url.c, lib/urldata.h.
    - CVE-2023-27536
  * SECURITY UPDATE: SSH connection too eager reuse still
    - debian/patches/CVE-2023-27538.patch: fix the SSH connection reuse
      check in lib/url.c.
    - CVE-2023-27538

 -- Marc Deslauriers <email address hidden> Tue, 14 Mar 2023 13:13:49 -0400

Source diff to previous version
CVE-2023-27533 RESERVED
CVE-2023-27534 RESERVED
CVE-2023-27535 RESERVED
CVE-2023-27536 RESERVED
CVE-2023-27538 RESERVED

Version: 7.68.0-1ubuntu2.16 2023-02-27 15:06:59 UTC

  curl (7.68.0-1ubuntu2.16) focal-security; urgency=medium

  * SECURITY UPDATE: HTTP multi-header compression denial of service
    - debian/patches/CVE-2023-23916.patch: do not reset stage counter for
      each header in lib/content_encoding.c, lib/urldata.h,
      tests/data/Makefile.inc, tests/data/test418.
    - CVE-2023-23916

 -- Marc Deslauriers <email address hidden> Wed, 15 Feb 2023 08:31:00 -0500

Source diff to previous version
CVE-2023-23916 An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, mea

Version: 7.68.0-1ubuntu2.15 2023-01-05 20:07:29 UTC

  curl (7.68.0-1ubuntu2.15) focal-security; urgency=medium

  * SECURITY UPDATE: HTTP Proxy deny use-after-free
    - debian/patches/CVE-2022-43552.patch: do not free the protocol struct
      in *_done() in lib/smb.c, lib/telnet.c.
    - CVE-2022-43552

 -- Marc Deslauriers <email address hidden> Wed, 04 Jan 2023 12:03:45 -0500

Source diff to previous version
CVE-2022-43552 HTTP Proxy deny use-after-free

Version: 7.68.0-1ubuntu2.14 2022-10-26 19:07:23 UTC

  curl (7.68.0-1ubuntu2.14) focal-security; urgency=medium

  * SECURITY UPDATE: POST following PUT confusion
    - debian/patches/CVE-2022-32221.patch: when POST is set, reset the
      'upload' field in lib/setopt.c.
    - CVE-2022-32221

 -- Marc Deslauriers <email address hidden> Tue, 18 Oct 2022 12:44:11 -0400

CVE-2022-32221 POST following PUT confusion



About   -   Send Feedback to @ubuntu_updates