Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:1763-1 Final 1 1 2021-05-26T10:32:05Z current 2021-05-26T10:32:05Z 2021-05-26T10:32:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: - CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114). - Allow partial chain verification [jsc#SLE-17956] * Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA certificates are. This allows users to verify servers using the intermediate cert only, instead of needing the whole chain. * Set FLAG_TRUSTED_FIRST unconditionally. * Do not check partial chains with CRL check. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sles12sp5:latest-2021-1763,Image SLES12-SP5-Azure-BYOS-2021-1763,Image SLES12-SP5-Azure-Basic-On-Demand-2021-1763,Image SLES12-SP5-Azure-HPC-BYOS-2021-1763,Image SLES12-SP5-Azure-HPC-On-Demand-2021-1763,Image SLES12-SP5-Azure-SAP-BYOS-2021-1763,Image SLES12-SP5-Azure-SAP-On-Demand-2021-1763,Image SLES12-SP5-Azure-Standard-On-Demand-2021-1763,Image SLES12-SP5-EC2-BYOS-2021-1763,Image SLES12-SP5-EC2-ECS-On-Demand-2021-1763,Image SLES12-SP5-EC2-On-Demand-2021-1763,Image SLES12-SP5-EC2-SAP-BYOS-2021-1763,Image SLES12-SP5-EC2-SAP-On-Demand-2021-1763,Image SLES12-SP5-GCE-BYOS-2021-1763,Image SLES12-SP5-GCE-On-Demand-2021-1763,Image SLES12-SP5-GCE-SAP-BYOS-2021-1763,Image SLES12-SP5-GCE-SAP-On-Demand-2021-1763,Image SLES12-SP5-OCI-BYOS-BYOS-2021-1763,Image SLES12-SP5-OCI-BYOS-SAP-BYOS-2021-1763,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2021-1763,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2021-1763,SUSE-2021-1763,SUSE-SLE-SDK-12-SP5-2021-1763,SUSE-SLE-SERVER-12-SP5-2021-1763 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20211763-1/ Link for SUSE-SU-2021:1763-1 https://lists.suse.com/pipermail/sle-security-updates/2021-May/008843.html E-Mail link for SUSE-SU-2021:1763-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1186114 SUSE Bug 1186114 https://www.suse.com/security/cve/CVE-2021-22898/ SUSE CVE CVE-2021-22898 page Container suse/sles12sp5:latest Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-OCI-BYOS-BYOS Image SLES12-SP5-OCI-BYOS-SAP-BYOS Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 libcurl4-7.60.0-11.18.1 curl-7.60.0-11.18.1 curl-mini-7.60.0-11.18.1 libcurl-devel-7.60.0-11.18.1 libcurl-devel-32bit-7.60.0-11.18.1 libcurl-devel-64bit-7.60.0-11.18.1 libcurl-mini-devel-7.60.0-11.18.1 libcurl4-32bit-7.60.0-11.18.1 libcurl4-64bit-7.60.0-11.18.1 libcurl4-mini-7.60.0-11.18.1 libcurl4-7.60.0-11.18.1 as a component of Container suse/sles12sp5:latest curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-BYOS libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-BYOS curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-EC2-BYOS libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-EC2-BYOS libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-EC2-On-Demand libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-EC2-On-Demand curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-GCE-BYOS libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-GCE-BYOS curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-GCE-On-Demand libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-GCE-On-Demand curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-OCI-BYOS-BYOS libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-OCI-BYOS-BYOS curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-OCI-BYOS-SAP-BYOS libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-OCI-BYOS-SAP-BYOS curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production curl-7.60.0-11.18.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libcurl4-7.60.0-11.18.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production curl-7.60.0-11.18.1 as a component of SUSE Linux Enterprise Server 12 SP5 libcurl4-7.60.0-11.18.1 as a component of SUSE Linux Enterprise Server 12 SP5 libcurl4-32bit-7.60.0-11.18.1 as a component of SUSE Linux Enterprise Server 12 SP5 curl-7.60.0-11.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libcurl4-7.60.0-11.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libcurl4-32bit-7.60.0-11.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libcurl-devel-7.60.0-11.18.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol. CVE-2021-22898 Container suse/sles12sp5:latest:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-Azure-BYOS:curl-7.60.0-11.18.1 Image SLES12-SP5-Azure-BYOS:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-Azure-Basic-On-Demand:curl-7.60.0-11.18.1 Image SLES12-SP5-Azure-Basic-On-Demand:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-Azure-HPC-BYOS:curl-7.60.0-11.18.1 Image SLES12-SP5-Azure-HPC-BYOS:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-Azure-HPC-On-Demand:curl-7.60.0-11.18.1 Image SLES12-SP5-Azure-HPC-On-Demand:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-Azure-SAP-BYOS:curl-7.60.0-11.18.1 Image SLES12-SP5-Azure-SAP-BYOS:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-Azure-SAP-On-Demand:curl-7.60.0-11.18.1 Image SLES12-SP5-Azure-SAP-On-Demand:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-Azure-Standard-On-Demand:curl-7.60.0-11.18.1 Image SLES12-SP5-Azure-Standard-On-Demand:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-EC2-BYOS:curl-7.60.0-11.18.1 Image SLES12-SP5-EC2-BYOS:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-EC2-ECS-On-Demand:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-EC2-On-Demand:curl-7.60.0-11.18.1 Image SLES12-SP5-EC2-On-Demand:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-EC2-SAP-BYOS:curl-7.60.0-11.18.1 Image SLES12-SP5-EC2-SAP-BYOS:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-EC2-SAP-On-Demand:curl-7.60.0-11.18.1 Image SLES12-SP5-EC2-SAP-On-Demand:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-GCE-BYOS:curl-7.60.0-11.18.1 Image SLES12-SP5-GCE-BYOS:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-GCE-On-Demand:curl-7.60.0-11.18.1 Image SLES12-SP5-GCE-On-Demand:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-GCE-SAP-BYOS:curl-7.60.0-11.18.1 Image SLES12-SP5-GCE-SAP-BYOS:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-GCE-SAP-On-Demand:curl-7.60.0-11.18.1 Image SLES12-SP5-GCE-SAP-On-Demand:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-OCI-BYOS-BYOS:curl-7.60.0-11.18.1 Image SLES12-SP5-OCI-BYOS-BYOS:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:curl-7.60.0-11.18.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:curl-7.60.0-11.18.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-11.18.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-11.18.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-11.18.1 SUSE Linux Enterprise Server 12 SP5:curl-7.60.0-11.18.1 SUSE Linux Enterprise Server 12 SP5:libcurl4-32bit-7.60.0-11.18.1 SUSE Linux Enterprise Server 12 SP5:libcurl4-7.60.0-11.18.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:curl-7.60.0-11.18.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libcurl4-32bit-7.60.0-11.18.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libcurl4-7.60.0-11.18.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libcurl-devel-7.60.0-11.18.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211763-1/ https://www.suse.com/security/cve/CVE-2021-22898.html CVE-2021-22898 https://bugzilla.suse.com/1186114 SUSE Bug 1186114 https://bugzilla.suse.com/1192450 SUSE Bug 1192450