Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1735-1 Final 1 1 2020-06-24T07:44:27Z current 2020-06-24T07:44:27Z 2020-06-24T07:44:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: - CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious server to overwrite a local file when using the -J option (bsc#1173027). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sles12sp4:latest-2020-1735,Image SLES12-SP4-Azure-BYOS-2020-1735,Image SLES12-SP4-EC2-HVM-BYOS-2020-1735,Image SLES12-SP4-GCE-BYOS-2020-1735,Image SLES12-SP4-OCI-BYOS-2020-1735,Image SLES12-SP4-SAP-Azure-2020-1735,Image SLES12-SP4-SAP-Azure-BYOS-2020-1735,Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2020-1735,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2020-1735,Image SLES12-SP4-SAP-EC2-HVM-2020-1735,Image SLES12-SP4-SAP-EC2-HVM-BYOS-2020-1735,Image SLES12-SP4-SAP-GCE-2020-1735,Image SLES12-SP4-SAP-GCE-BYOS-2020-1735,Image SLES12-SP4-SAP-OCI-BYOS-2020-1735,SUSE-2020-1735,SUSE-SLE-SDK-12-SP4-2020-1735,SUSE-SLE-SERVER-12-SP4-2020-1735 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201735-1/ Link for SUSE-SU-2020:1735-1 https://lists.suse.com/pipermail/sle-security-updates/2020-June/007023.html E-Mail link for SUSE-SU-2020:1735-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1173027 SUSE Bug 1173027 https://www.suse.com/security/cve/CVE-2020-8177/ SUSE CVE CVE-2020-8177 page Container suse/sles12sp4:latest Image SLES12-SP4-Azure-BYOS Image SLES12-SP4-EC2-HVM-BYOS Image SLES12-SP4-GCE-BYOS Image SLES12-SP4-OCI-BYOS Image SLES12-SP4-SAP-Azure Image SLES12-SP4-SAP-Azure-BYOS Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production Image SLES12-SP4-SAP-EC2-HVM Image SLES12-SP4-SAP-EC2-HVM-BYOS Image SLES12-SP4-SAP-GCE Image SLES12-SP4-SAP-GCE-BYOS Image SLES12-SP4-SAP-OCI-BYOS SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4 libcurl4-7.60.0-4.15.2 curl-7.60.0-4.15.2 curl-mini-7.60.0-4.15.2 libcurl-devel-7.60.0-4.15.2 libcurl-devel-32bit-7.60.0-4.15.2 libcurl-devel-64bit-7.60.0-4.15.2 libcurl-mini-devel-7.60.0-4.15.2 libcurl4-32bit-7.60.0-4.15.2 libcurl4-64bit-7.60.0-4.15.2 libcurl4-mini-7.60.0-4.15.2 libcurl4-7.60.0-4.15.2 as a component of Container suse/sles12sp4:latest curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-Azure-BYOS libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-Azure-BYOS curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-EC2-HVM-BYOS libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-EC2-HVM-BYOS curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-GCE-BYOS libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-GCE-BYOS curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-OCI-BYOS libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-OCI-BYOS curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-Azure libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-Azure curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-Azure-BYOS libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-Azure-BYOS curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-EC2-HVM libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-EC2-HVM curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-GCE libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-GCE curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-GCE-BYOS libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-GCE-BYOS curl-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-OCI-BYOS libcurl4-7.60.0-4.15.2 as a component of Image SLES12-SP4-SAP-OCI-BYOS curl-7.60.0-4.15.2 as a component of SUSE Linux Enterprise Server 12 SP4 libcurl4-7.60.0-4.15.2 as a component of SUSE Linux Enterprise Server 12 SP4 libcurl4-32bit-7.60.0-4.15.2 as a component of SUSE Linux Enterprise Server 12 SP4 curl-7.60.0-4.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libcurl4-7.60.0-4.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libcurl4-32bit-7.60.0-4.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libcurl-devel-7.60.0-4.15.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used. CVE-2020-8177 Container suse/sles12sp4:latest:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-Azure-BYOS:curl-7.60.0-4.15.2 Image SLES12-SP4-Azure-BYOS:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-EC2-HVM-BYOS:curl-7.60.0-4.15.2 Image SLES12-SP4-EC2-HVM-BYOS:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-GCE-BYOS:curl-7.60.0-4.15.2 Image SLES12-SP4-GCE-BYOS:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-OCI-BYOS:curl-7.60.0-4.15.2 Image SLES12-SP4-OCI-BYOS:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-SAP-Azure-BYOS:curl-7.60.0-4.15.2 Image SLES12-SP4-SAP-Azure-BYOS:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:curl-7.60.0-4.15.2 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-4.15.2 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-SAP-Azure:curl-7.60.0-4.15.2 Image SLES12-SP4-SAP-Azure:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-SAP-EC2-HVM-BYOS:curl-7.60.0-4.15.2 Image SLES12-SP4-SAP-EC2-HVM-BYOS:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-SAP-EC2-HVM:curl-7.60.0-4.15.2 Image SLES12-SP4-SAP-EC2-HVM:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-SAP-GCE-BYOS:curl-7.60.0-4.15.2 Image SLES12-SP4-SAP-GCE-BYOS:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-SAP-GCE:curl-7.60.0-4.15.2 Image SLES12-SP4-SAP-GCE:libcurl4-7.60.0-4.15.2 Image SLES12-SP4-SAP-OCI-BYOS:curl-7.60.0-4.15.2 Image SLES12-SP4-SAP-OCI-BYOS:libcurl4-7.60.0-4.15.2 SUSE Linux Enterprise Server 12 SP4:curl-7.60.0-4.15.2 SUSE Linux Enterprise Server 12 SP4:libcurl4-32bit-7.60.0-4.15.2 SUSE Linux Enterprise Server 12 SP4:libcurl4-7.60.0-4.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:curl-7.60.0-4.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-32bit-7.60.0-4.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-7.60.0-4.15.2 SUSE Linux Enterprise Software Development Kit 12 SP4:libcurl-devel-7.60.0-4.15.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201735-1/ https://www.suse.com/security/cve/CVE-2020-8177.html CVE-2020-8177 https://bugzilla.suse.com/1173027 SUSE Bug 1173027 https://bugzilla.suse.com/1186108 SUSE Bug 1186108