Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2813-1 Final 1 1 2022-08-16T08:42:24Z current 2022-08-16T08:42:24Z 2022-08-16T08:42:24Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: - CVE-2022-27781: Fixed an issue where curl will get stuck in an infinite loop when trying to retrieve details about a TLS server's certificate chain (bnc#1199223). - CVE-2022-27782: Fixed an issue where TLS and SSH connections would be reused even when a related option had been changed (bsc#1199224). - CVE-2022-32206: Fixed an uncontrolled memory consumption issue caused by an unbounded number of compression layers (bsc#1200735). - CVE-2022-32208: Fixed an incorrect message verification issue when performing FTP transfers using krb5 (bsc#1200737). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sles12sp4:latest-2022-2813,Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2022-2813,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2022-2813,SUSE-2022-2813,SUSE-OpenStack-Cloud-9-2022-2813,SUSE-OpenStack-Cloud-Crowbar-9-2022-2813,SUSE-SLE-SAP-12-SP4-2022-2813,SUSE-SLE-SERVER-12-SP4-LTSS-2022-2813 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222813-1/ Link for SUSE-SU-2022:2813-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/011916.html E-Mail link for SUSE-SU-2022:2813-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1199223 SUSE Bug 1199223 https://bugzilla.suse.com/1199224 SUSE Bug 1199224 https://bugzilla.suse.com/1200735 SUSE Bug 1200735 https://bugzilla.suse.com/1200737 SUSE Bug 1200737 https://www.suse.com/security/cve/CVE-2022-27781/ SUSE CVE CVE-2022-27781 page https://www.suse.com/security/cve/CVE-2022-27782/ SUSE CVE CVE-2022-27782 page https://www.suse.com/security/cve/CVE-2022-32206/ SUSE CVE CVE-2022-32206 page https://www.suse.com/security/cve/CVE-2022-32208/ SUSE CVE CVE-2022-32208 page Container suse/sles12sp4:latest Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 libcurl4-7.60.0-4.38.1 curl-7.60.0-4.38.1 curl-mini-7.60.0-4.38.1 libcurl-devel-7.60.0-4.38.1 libcurl-devel-32bit-7.60.0-4.38.1 libcurl-devel-64bit-7.60.0-4.38.1 libcurl-mini-devel-7.60.0-4.38.1 libcurl4-32bit-7.60.0-4.38.1 libcurl4-64bit-7.60.0-4.38.1 libcurl4-mini-7.60.0-4.38.1 libcurl4-7.60.0-4.38.1 as a component of Container suse/sles12sp4:latest curl-7.60.0-4.38.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production libcurl4-7.60.0-4.38.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production curl-7.60.0-4.38.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production libcurl4-7.60.0-4.38.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production curl-7.60.0-4.38.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libcurl4-7.60.0-4.38.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libcurl4-32bit-7.60.0-4.38.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS curl-7.60.0-4.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libcurl4-7.60.0-4.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libcurl4-32bit-7.60.0-4.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 curl-7.60.0-4.38.1 as a component of SUSE OpenStack Cloud 9 libcurl4-7.60.0-4.38.1 as a component of SUSE OpenStack Cloud 9 libcurl4-32bit-7.60.0-4.38.1 as a component of SUSE OpenStack Cloud 9 curl-7.60.0-4.38.1 as a component of SUSE OpenStack Cloud Crowbar 9 libcurl4-7.60.0-4.38.1 as a component of SUSE OpenStack Cloud Crowbar 9 libcurl4-32bit-7.60.0-4.38.1 as a component of SUSE OpenStack Cloud Crowbar 9 libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation. CVE-2022-27781 Container suse/sles12sp4:latest:libcurl4-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:curl-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:curl-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libcurl4-32bit-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libcurl4-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:curl-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-32bit-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-7.60.0-4.38.1 SUSE OpenStack Cloud 9:curl-7.60.0-4.38.1 SUSE OpenStack Cloud 9:libcurl4-32bit-7.60.0-4.38.1 SUSE OpenStack Cloud 9:libcurl4-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:curl-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:libcurl4-32bit-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:libcurl4-7.60.0-4.38.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222813-1/ https://www.suse.com/security/cve/CVE-2022-27781.html CVE-2022-27781 https://bugzilla.suse.com/1199223 SUSE Bug 1199223 libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily. CVE-2022-27782 Container suse/sles12sp4:latest:libcurl4-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:curl-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:curl-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libcurl4-32bit-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libcurl4-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:curl-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-32bit-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-7.60.0-4.38.1 SUSE OpenStack Cloud 9:curl-7.60.0-4.38.1 SUSE OpenStack Cloud 9:libcurl4-32bit-7.60.0-4.38.1 SUSE OpenStack Cloud 9:libcurl4-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:curl-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:libcurl4-32bit-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:libcurl4-7.60.0-4.38.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222813-1/ https://www.suse.com/security/cve/CVE-2022-27782.html CVE-2022-27782 https://bugzilla.suse.com/1199224 SUSE Bug 1199224 https://bugzilla.suse.com/1200694 SUSE Bug 1200694 https://bugzilla.suse.com/1203786 SUSE Bug 1203786 https://bugzilla.suse.com/1205070 SUSE Bug 1205070 https://bugzilla.suse.com/1209214 SUSE Bug 1209214 curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. CVE-2022-32206 Container suse/sles12sp4:latest:libcurl4-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:curl-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:curl-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libcurl4-32bit-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libcurl4-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:curl-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-32bit-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-7.60.0-4.38.1 SUSE OpenStack Cloud 9:curl-7.60.0-4.38.1 SUSE OpenStack Cloud 9:libcurl4-32bit-7.60.0-4.38.1 SUSE OpenStack Cloud 9:libcurl4-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:curl-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:libcurl4-32bit-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:libcurl4-7.60.0-4.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222813-1/ https://www.suse.com/security/cve/CVE-2022-32206.html CVE-2022-32206 https://bugzilla.suse.com/1200735 SUSE Bug 1200735 https://bugzilla.suse.com/1207992 SUSE Bug 1207992 When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. CVE-2022-32208 Container suse/sles12sp4:latest:libcurl4-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:curl-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-4.38.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:curl-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libcurl4-32bit-7.60.0-4.38.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libcurl4-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:curl-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-32bit-7.60.0-4.38.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-7.60.0-4.38.1 SUSE OpenStack Cloud 9:curl-7.60.0-4.38.1 SUSE OpenStack Cloud 9:libcurl4-32bit-7.60.0-4.38.1 SUSE OpenStack Cloud 9:libcurl4-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:curl-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:libcurl4-32bit-7.60.0-4.38.1 SUSE OpenStack Cloud Crowbar 9:libcurl4-7.60.0-4.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222813-1/ https://www.suse.com/security/cve/CVE-2022-32208.html CVE-2022-32208 https://bugzilla.suse.com/1200737 SUSE Bug 1200737