USN-818-1: curl vulnerability
17 August 2009
curl vulnerability
Releases
Packages
- curl -
Details
Scott Cantor discovered that Curl did not correctly handle SSL
certificates with zero bytes in the Common Name. A remote attacker could
exploit this to perform a machine-in-the-middle attack to view sensitive
information or alter encrypted communications.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 9.04
Ubuntu 8.10
Ubuntu 8.04
Ubuntu 6.06
In general, a standard system upgrade is sufficient to effect the
necessary changes.
References
Related notices
- USN-1158-1: libcurl3, libcurl3-gnutls, libcurl3-nss, curl