Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2449-1 Final 1 1 2016-10-04T11:46:43Z current 2016-10-04T11:46:43Z 2016-10-04T11:46:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: - CVE-2016-5419: TLS session resumption client cert bypass (bsc#991389) - CVE-2016-5420: Re-using connections with wrong client cert (bsc#991390) - CVE-2016-7141: Fixed incorrect reuse of client certificates (bsc#997420). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-curl-12772,secsp3-curl-12772,sleclo50sp3-curl-12772,sleman21-curl-12772,slemap21-curl-12772,sleposp3-curl-12772,slessp3-curl-12772,slessp4-curl-12772 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162449-1/ Link for SUSE-SU-2016:2449-1 https://lists.suse.com/pipermail/sle-security-updates/2016-October/002306.html E-Mail link for SUSE-SU-2016:2449-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/991389 SUSE Bug 991389 https://bugzilla.suse.com/991390 SUSE Bug 991390 https://bugzilla.suse.com/997420 SUSE Bug 997420 https://www.suse.com/security/cve/CVE-2016-5419/ SUSE CVE CVE-2016-5419 page https://www.suse.com/security/cve/CVE-2016-5420/ SUSE CVE CVE-2016-5420 page https://www.suse.com/security/cve/CVE-2016-7141/ SUSE CVE CVE-2016-7141 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server 11-SECURITY SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Manager 2.1 SUSE Manager Proxy 2.1 SUSE OpenStack Cloud 5 libcurl-devel-7.19.7-1.61.1 curl-openssl1-7.19.7-1.61.1 libcurl4-openssl1-7.19.7-1.61.1 libcurl4-openssl1-32bit-7.19.7-1.61.1 libcurl4-openssl1-x86-7.19.7-1.61.1 curl-7.19.7-1.61.1 libcurl4-7.19.7-1.61.1 libcurl4-32bit-7.19.7-1.61.1 libcurl4-x86-7.19.7-1.61.1 curl-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 libcurl4-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 curl-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS curl-openssl1-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS libcurl4-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS libcurl4-32bit-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS libcurl4-openssl1-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS libcurl4-openssl1-32bit-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS curl-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA curl-openssl1-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-32bit-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-openssl1-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-openssl1-32bit-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA curl-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP4 libcurl4-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP4 libcurl4-32bit-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP4 libcurl4-x86-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11 SP4 curl-openssl1-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libcurl4-openssl1-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libcurl4-openssl1-32bit-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libcurl4-openssl1-x86-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server 11-SECURITY curl-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libcurl4-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libcurl4-32bit-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libcurl4-x86-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libcurl-devel-7.19.7-1.61.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 curl-7.19.7-1.61.1 as a component of SUSE Manager 2.1 libcurl4-7.19.7-1.61.1 as a component of SUSE Manager 2.1 libcurl4-32bit-7.19.7-1.61.1 as a component of SUSE Manager 2.1 curl-7.19.7-1.61.1 as a component of SUSE Manager Proxy 2.1 libcurl4-7.19.7-1.61.1 as a component of SUSE Manager Proxy 2.1 libcurl4-32bit-7.19.7-1.61.1 as a component of SUSE Manager Proxy 2.1 curl-7.19.7-1.61.1 as a component of SUSE OpenStack Cloud 5 libcurl4-7.19.7-1.61.1 as a component of SUSE OpenStack Cloud 5 libcurl4-32bit-7.19.7-1.61.1 as a component of SUSE OpenStack Cloud 5 curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. CVE-2016-5419 SUSE Linux Enterprise Point of Sale 11 SP3:curl-7.19.7-1.61.1 SUSE Linux Enterprise Point of Sale 11 SP3:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-x86-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:curl-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-x86-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-x86-7.19.7-1.61.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libcurl-devel-7.19.7-1.61.1 SUSE Manager 2.1:curl-7.19.7-1.61.1 SUSE Manager 2.1:libcurl4-32bit-7.19.7-1.61.1 SUSE Manager 2.1:libcurl4-7.19.7-1.61.1 SUSE Manager Proxy 2.1:curl-7.19.7-1.61.1 SUSE Manager Proxy 2.1:libcurl4-32bit-7.19.7-1.61.1 SUSE Manager Proxy 2.1:libcurl4-7.19.7-1.61.1 SUSE OpenStack Cloud 5:curl-7.19.7-1.61.1 SUSE OpenStack Cloud 5:libcurl4-32bit-7.19.7-1.61.1 SUSE OpenStack Cloud 5:libcurl4-7.19.7-1.61.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162449-1/ https://www.suse.com/security/cve/CVE-2016-5419.html CVE-2016-5419 https://bugzilla.suse.com/1033413 SUSE Bug 1033413 https://bugzilla.suse.com/1033442 SUSE Bug 1033442 https://bugzilla.suse.com/991389 SUSE Bug 991389 curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. CVE-2016-5420 SUSE Linux Enterprise Point of Sale 11 SP3:curl-7.19.7-1.61.1 SUSE Linux Enterprise Point of Sale 11 SP3:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-x86-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:curl-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-x86-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-x86-7.19.7-1.61.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libcurl-devel-7.19.7-1.61.1 SUSE Manager 2.1:curl-7.19.7-1.61.1 SUSE Manager 2.1:libcurl4-32bit-7.19.7-1.61.1 SUSE Manager 2.1:libcurl4-7.19.7-1.61.1 SUSE Manager Proxy 2.1:curl-7.19.7-1.61.1 SUSE Manager Proxy 2.1:libcurl4-32bit-7.19.7-1.61.1 SUSE Manager Proxy 2.1:libcurl4-7.19.7-1.61.1 SUSE OpenStack Cloud 5:curl-7.19.7-1.61.1 SUSE OpenStack Cloud 5:libcurl4-32bit-7.19.7-1.61.1 SUSE OpenStack Cloud 5:libcurl4-7.19.7-1.61.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162449-1/ https://www.suse.com/security/cve/CVE-2016-5420.html CVE-2016-5420 https://bugzilla.suse.com/991390 SUSE Bug 991390 https://bugzilla.suse.com/997420 SUSE Bug 997420 curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420. CVE-2016-7141 SUSE Linux Enterprise Point of Sale 11 SP3:curl-7.19.7-1.61.1 SUSE Linux Enterprise Point of Sale 11 SP3:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-x86-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:curl-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-7.19.7-1.61.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-x86-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:curl-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-32bit-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-7.19.7-1.61.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-x86-7.19.7-1.61.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libcurl-devel-7.19.7-1.61.1 SUSE Manager 2.1:curl-7.19.7-1.61.1 SUSE Manager 2.1:libcurl4-32bit-7.19.7-1.61.1 SUSE Manager 2.1:libcurl4-7.19.7-1.61.1 SUSE Manager Proxy 2.1:curl-7.19.7-1.61.1 SUSE Manager Proxy 2.1:libcurl4-32bit-7.19.7-1.61.1 SUSE Manager Proxy 2.1:libcurl4-7.19.7-1.61.1 SUSE OpenStack Cloud 5:curl-7.19.7-1.61.1 SUSE OpenStack Cloud 5:libcurl4-32bit-7.19.7-1.61.1 SUSE OpenStack Cloud 5:libcurl4-7.19.7-1.61.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162449-1/ https://www.suse.com/security/cve/CVE-2016-7141.html CVE-2016-7141 https://bugzilla.suse.com/991390 SUSE Bug 991390 https://bugzilla.suse.com/997420 SUSE Bug 997420