Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2330-1 Final 1 1 2016-09-16T15:13:59Z current 2016-09-16T15:13:59Z 2016-09-16T15:13:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: Security issues fixed: - CVE-2016-5419: TLS session resumption client cert bypass (bsc#991389) - CVE-2016-5420: Re-using connections with wrong client cert (bsc#991390) - CVE-2016-5421: use of connection struct after free (bsc#991391) - CVE-2016-7141: Fixed incorrect reuse of client certificates with NSS (bsc#997420) Also the following bug was fixed: - fixing a performance issue (bsc#991746) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2016-1364,SUSE-SLE-SDK-12-SP1-2016-1364,SUSE-SLE-SERVER-12-SP1-2016-1364 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162330-1/ Link for SUSE-SU-2016:2330-1 https://lists.suse.com/pipermail/sle-security-updates/2016-September/002278.html E-Mail link for SUSE-SU-2016:2330-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/991389 SUSE Bug 991389 https://bugzilla.suse.com/991390 SUSE Bug 991390 https://bugzilla.suse.com/991391 SUSE Bug 991391 https://bugzilla.suse.com/991746 SUSE Bug 991746 https://bugzilla.suse.com/997420 SUSE Bug 997420 https://www.suse.com/security/cve/CVE-2016-5419/ SUSE CVE CVE-2016-5419 page https://www.suse.com/security/cve/CVE-2016-5420/ SUSE CVE CVE-2016-5420 page https://www.suse.com/security/cve/CVE-2016-5421/ SUSE CVE CVE-2016-5421 page https://www.suse.com/security/cve/CVE-2016-7141/ SUSE CVE CVE-2016-7141 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP1 curl-7.37.0-28.1 libcurl4-7.37.0-28.1 libcurl4-32bit-7.37.0-28.1 libcurl-devel-7.37.0-28.1 curl-7.37.0-28.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libcurl4-7.37.0-28.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libcurl4-32bit-7.37.0-28.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 curl-7.37.0-28.1 as a component of SUSE Linux Enterprise Server 12 SP1 libcurl4-7.37.0-28.1 as a component of SUSE Linux Enterprise Server 12 SP1 libcurl4-32bit-7.37.0-28.1 as a component of SUSE Linux Enterprise Server 12 SP1 curl-7.37.0-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libcurl4-7.37.0-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libcurl4-32bit-7.37.0-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libcurl-devel-7.37.0-28.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. CVE-2016-5419 SUSE Linux Enterprise Desktop 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Desktop 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Desktop 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libcurl-devel-7.37.0-28.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162330-1/ https://www.suse.com/security/cve/CVE-2016-5419.html CVE-2016-5419 https://bugzilla.suse.com/1033413 SUSE Bug 1033413 https://bugzilla.suse.com/1033442 SUSE Bug 1033442 https://bugzilla.suse.com/991389 SUSE Bug 991389 curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. CVE-2016-5420 SUSE Linux Enterprise Desktop 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Desktop 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Desktop 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libcurl-devel-7.37.0-28.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162330-1/ https://www.suse.com/security/cve/CVE-2016-5420.html CVE-2016-5420 https://bugzilla.suse.com/991390 SUSE Bug 991390 https://bugzilla.suse.com/997420 SUSE Bug 997420 Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors. CVE-2016-5421 SUSE Linux Enterprise Desktop 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Desktop 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Desktop 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libcurl-devel-7.37.0-28.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162330-1/ https://www.suse.com/security/cve/CVE-2016-5421.html CVE-2016-5421 https://bugzilla.suse.com/991391 SUSE Bug 991391 curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420. CVE-2016-7141 SUSE Linux Enterprise Desktop 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Desktop 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Desktop 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Server 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:curl-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libcurl4-32bit-7.37.0-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libcurl4-7.37.0-28.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libcurl-devel-7.37.0-28.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162330-1/ https://www.suse.com/security/cve/CVE-2016-7141.html CVE-2016-7141 https://bugzilla.suse.com/991390 SUSE Bug 991390 https://bugzilla.suse.com/997420 SUSE Bug 997420