USN-5397-1: curl vulnerabilities

Releases

• Ubuntu 22.04 LTS
• Ubuntu 21.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• curl - HTTP, HTTPS, and FTP client and client libraries

Details

Patrick Monnerat discovered that curl incorrectly handled certain OAUTH2.
An attacker could possibly use this issue to access sensitive information.
(CVE-2022-22576)

Harry Sintonen discovered that curl incorrectly handled certain requests.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2022-27774, CVE-2022-27775, CVE-2022-27776)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• libcurl3-gnutls - 7.81.0-1ubuntu1.1
• libcurl3-nss - 7.81.0-1ubuntu1.1
• libcurl4 - 7.81.0-1ubuntu1.1
• curl - 7.81.0-1ubuntu1.1

Ubuntu 21.10

• libcurl3-gnutls - 7.74.0-1.3ubuntu2.1
• libcurl3-nss - 7.74.0-1.3ubuntu2.1
• libcurl4 - 7.74.0-1.3ubuntu2.1
• curl - 7.74.0-1.3ubuntu2.1

Ubuntu 20.04

• libcurl3-gnutls - 7.68.0-1ubuntu2.10
• libcurl3-nss - 7.68.0-1ubuntu2.10
• libcurl4 - 7.68.0-1ubuntu2.10
• curl - 7.68.0-1ubuntu2.10

Ubuntu 18.04

• libcurl3-gnutls - 7.58.0-2ubuntu3.17
• libcurl3-nss - 7.58.0-2ubuntu3.17
• libcurl4 - 7.58.0-2ubuntu3.17
• curl - 7.58.0-2ubuntu3.17

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-27774
• CVE-2022-27776
• CVE-2022-22576
• CVE-2022-27775