Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2155-1 Final 1 1 2016-08-25T13:04:29Z current 2016-08-25T13:04:29Z 2016-08-25T13:04:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: - CVE-2016-5419: TLS session resumption client cert bypass (bsc#991389) - CVE-2016-5420: Re-using connections with wrong client cert (bsc#991390) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slestso13-curl-12713 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162155-1/ Link for SUSE-SU-2016:2155-1 https://lists.suse.com/pipermail/sle-security-updates/2016-August/002229.html E-Mail link for SUSE-SU-2016:2155-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/991389 SUSE Bug 991389 https://bugzilla.suse.com/991390 SUSE Bug 991390 https://www.suse.com/security/cve/CVE-2016-5419/ SUSE CVE CVE-2016-5419 page https://www.suse.com/security/cve/CVE-2016-5420/ SUSE CVE CVE-2016-5420 page SUSE Studio Onsite 1.3 libcurl-devel-7.19.7-1.20.42.1 libcurl-devel-7.19.7-1.20.42.1 as a component of SUSE Studio Onsite 1.3 curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. CVE-2016-5419 SUSE Studio Onsite 1.3:libcurl-devel-7.19.7-1.20.42.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162155-1/ https://www.suse.com/security/cve/CVE-2016-5419.html CVE-2016-5419 https://bugzilla.suse.com/1033413 SUSE Bug 1033413 https://bugzilla.suse.com/1033442 SUSE Bug 1033442 https://bugzilla.suse.com/991389 SUSE Bug 991389 curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. CVE-2016-5420 SUSE Studio Onsite 1.3:libcurl-devel-7.19.7-1.20.42.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162155-1/ https://www.suse.com/security/cve/CVE-2016-5420.html CVE-2016-5420 https://bugzilla.suse.com/991390 SUSE Bug 991390 https://bugzilla.suse.com/997420 SUSE Bug 997420