USN-7104-1: curl vulnerability

Releases

• Ubuntu 24.10
• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS

Packages

• curl - HTTP, HTTPS, and FTP client and client libraries

Details

It was discovered that curl could overwrite the HSTS expiry of the parent
domain with the subdomain's HSTS entry. This could lead to curl switching
back to insecure HTTP earlier than otherwise intended, resulting in
information exposure.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.10

• curl - 8.9.1-2ubuntu2.1
• libcurl3t64-gnutls - 8.9.1-2ubuntu2.1
• libcurl4t64 - 8.9.1-2ubuntu2.1

Ubuntu 24.04

• curl - 8.5.0-2ubuntu10.5
• libcurl3t64-gnutls - 8.5.0-2ubuntu10.5
• libcurl4t64 - 8.5.0-2ubuntu10.5

Ubuntu 22.04

• curl - 7.81.0-1ubuntu1.19
• libcurl3-gnutls - 7.81.0-1ubuntu1.19
• libcurl3-nss - 7.81.0-1ubuntu1.19
• libcurl4 - 7.81.0-1ubuntu1.19

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-9681