Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:14585-1 Final 1 1 2020-12-21T09:57:35Z current 2020-12-21T09:57:35Z 2020-12-21T09:57:35Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: - CVE-2020-8284: Fixed an issue where a malicious FTP server could make curl connect to a different IP (bsc#1179398). - CVE-2020-8285: Fixed an FTP wildcard stack overflow (bsc#1179399). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). secsp3-curl-14585 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-202014585-1/ Link for SUSE-SU-2020:14585-1 https://lists.suse.com/pipermail/sle-security-updates/2020-December/008095.html E-Mail link for SUSE-SU-2020:14585-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1179398 SUSE Bug 1179398 https://bugzilla.suse.com/1179399 SUSE Bug 1179399 https://www.suse.com/security/cve/CVE-2020-8284/ SUSE CVE CVE-2020-8284 page https://www.suse.com/security/cve/CVE-2020-8285/ SUSE CVE CVE-2020-8285 page SUSE Linux Enterprise Server 11-SECURITY curl-openssl1-7.37.0-70.57.1 libcurl4-openssl1-7.37.0-70.57.1 libcurl4-openssl1-32bit-7.37.0-70.57.1 libcurl4-openssl1-x86-7.37.0-70.57.1 curl-openssl1-7.37.0-70.57.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libcurl4-openssl1-7.37.0-70.57.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libcurl4-openssl1-32bit-7.37.0-70.57.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libcurl4-openssl1-x86-7.37.0-70.57.1 as a component of SUSE Linux Enterprise Server 11-SECURITY A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. CVE-2020-8284 SUSE Linux Enterprise Server 11-SECURITY:curl-openssl1-7.37.0-70.57.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-32bit-7.37.0-70.57.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-7.37.0-70.57.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-x86-7.37.0-70.57.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014585-1/ https://www.suse.com/security/cve/CVE-2020-8284.html CVE-2020-8284 https://bugzilla.suse.com/1179398 SUSE Bug 1179398 https://bugzilla.suse.com/1179399 SUSE Bug 1179399 https://bugzilla.suse.com/1186108 SUSE Bug 1186108 curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. CVE-2020-8285 SUSE Linux Enterprise Server 11-SECURITY:curl-openssl1-7.37.0-70.57.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-32bit-7.37.0-70.57.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-7.37.0-70.57.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-x86-7.37.0-70.57.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014585-1/ https://www.suse.com/security/cve/CVE-2020-8285.html CVE-2020-8285 https://bugzilla.suse.com/1179399 SUSE Bug 1179399 https://bugzilla.suse.com/1186108 SUSE Bug 1186108