Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2829-1 Final 1 1 2022-08-17T11:33:38Z current 2022-08-17T11:33:38Z 2022-08-17T11:33:38Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: - CVE-2022-27781: Fixed an issue where curl will get stuck in an infinite loop when trying to retrieve details about a TLS server's certificate chain (bnc#1199223). - CVE-2022-27782: Fixed an issue where TLS and SSH connections would be reused even when a related option had been changed (bsc#1199224). - CVE-2022-32206: Fixed an uncontrolled memory consumption issue caused by an unbounded number of compression layers (bsc#1200735). - CVE-2022-32208: Fixed an incorrect message verification issue when performing FTP transfers using krb5 (bsc#1200737). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container caasp/v4/helm-tiller:2.16.12-2022-2829,Container suse/sle15:15.0-2022-2829,Container suse/sle15:15.1-2022-2829,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2022-2829,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2022-2829,Image SLES15-SP1-SAPCAL-Azure-2022-2829,Image SLES15-SP1-SAPCAL-EC2-HVM-2022-2829,Image SLES15-SP1-SAPCAL-GCE-2022-2829,SUSE-2022-2829,SUSE-SLE-Product-HPC-15-2022-2829,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-2829,SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-2829,SUSE-SLE-Product-SLES-15-2022-2829,SUSE-SLE-Product-SLES-15-SP1-BCL-2022-2829,SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-2829,SUSE-SLE-Product-SLES_SAP-15-2022-2829,SUSE-SLE-Product-SLES_SAP-15-SP1-2022-2829,SUSE-Storage-6-2022-2829 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222829-1/ Link for SUSE-SU-2022:2829-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/011931.html E-Mail link for SUSE-SU-2022:2829-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1199223 SUSE Bug 1199223 https://bugzilla.suse.com/1199224 SUSE Bug 1199224 https://bugzilla.suse.com/1200735 SUSE Bug 1200735 https://bugzilla.suse.com/1200737 SUSE Bug 1200737 https://www.suse.com/security/cve/CVE-2022-27781/ SUSE CVE CVE-2022-27781 page https://www.suse.com/security/cve/CVE-2022-27782/ SUSE CVE CVE-2022-27782 page https://www.suse.com/security/cve/CVE-2022-32206/ SUSE CVE CVE-2022-32206 page https://www.suse.com/security/cve/CVE-2022-32208/ SUSE CVE CVE-2022-32208 page Container caasp/v4/helm-tiller:2.16.12 Container suse/sle15:15.0 Container suse/sle15:15.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP1-SAPCAL-Azure Image SLES15-SP1-SAPCAL-EC2-HVM Image SLES15-SP1-SAPCAL-GCE SUSE Enterprise Storage 6 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15 SP1-BCL SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl4-7.60.0-150000.33.1 curl-7.60.0-150000.33.1 libcurl-devel-7.60.0-150000.33.1 curl-mini-7.60.0-150000.33.1 libcurl-devel-32bit-7.60.0-150000.33.1 libcurl-devel-64bit-7.60.0-150000.33.1 libcurl-mini-devel-7.60.0-150000.33.1 libcurl4-32bit-7.60.0-150000.33.1 libcurl4-64bit-7.60.0-150000.33.1 libcurl4-mini-7.60.0-150000.33.1 libcurl4-7.60.0-150000.33.1 as a component of Container caasp/v4/helm-tiller:2.16.12 libcurl4-7.60.0-150000.33.1 as a component of Container suse/sle15:15.0 libcurl4-7.60.0-150000.33.1 as a component of Container suse/sle15:15.1 curl-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production libcurl4-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production curl-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production libcurl4-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production curl-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAPCAL-Azure libcurl-devel-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAPCAL-Azure libcurl4-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAPCAL-Azure curl-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM libcurl-devel-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM libcurl4-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM curl-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAPCAL-GCE libcurl-devel-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAPCAL-GCE libcurl4-7.60.0-150000.33.1 as a component of Image SLES15-SP1-SAPCAL-GCE curl-7.60.0-150000.33.1 as a component of SUSE Enterprise Storage 6 libcurl-devel-7.60.0-150000.33.1 as a component of SUSE Enterprise Storage 6 libcurl4-7.60.0-150000.33.1 as a component of SUSE Enterprise Storage 6 libcurl4-32bit-7.60.0-150000.33.1 as a component of SUSE Enterprise Storage 6 curl-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libcurl-devel-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libcurl4-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libcurl4-32bit-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS curl-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libcurl-devel-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libcurl4-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libcurl4-32bit-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS curl-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libcurl-devel-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libcurl4-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libcurl4-32bit-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS curl-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libcurl-devel-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libcurl4-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libcurl4-32bit-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS curl-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL libcurl-devel-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL libcurl4-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL libcurl4-32bit-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL curl-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libcurl-devel-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libcurl4-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libcurl4-32bit-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS curl-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15-LTSS libcurl-devel-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15-LTSS libcurl4-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15-LTSS libcurl4-32bit-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server 15-LTSS curl-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libcurl-devel-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libcurl4-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libcurl4-32bit-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 curl-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl-devel-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl4-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl4-32bit-7.60.0-150000.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation. CVE-2022-27781 Container caasp/v4/helm-tiller:2.16.12:libcurl4-7.60.0-150000.33.1 Container suse/sle15:15.0:libcurl4-7.60.0-150000.33.1 Container suse/sle15:15.1:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:libcurl4-7.60.0-150000.33.1 SUSE Enterprise Storage 6:curl-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl-devel-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl4-32bit-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-7.60.0-150000.33.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222829-1/ https://www.suse.com/security/cve/CVE-2022-27781.html CVE-2022-27781 https://bugzilla.suse.com/1199223 SUSE Bug 1199223 libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily. CVE-2022-27782 Container caasp/v4/helm-tiller:2.16.12:libcurl4-7.60.0-150000.33.1 Container suse/sle15:15.0:libcurl4-7.60.0-150000.33.1 Container suse/sle15:15.1:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:libcurl4-7.60.0-150000.33.1 SUSE Enterprise Storage 6:curl-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl-devel-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl4-32bit-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-7.60.0-150000.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222829-1/ https://www.suse.com/security/cve/CVE-2022-27782.html CVE-2022-27782 https://bugzilla.suse.com/1199224 SUSE Bug 1199224 https://bugzilla.suse.com/1200694 SUSE Bug 1200694 https://bugzilla.suse.com/1203786 SUSE Bug 1203786 https://bugzilla.suse.com/1205070 SUSE Bug 1205070 https://bugzilla.suse.com/1209214 SUSE Bug 1209214 curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. CVE-2022-32206 Container caasp/v4/helm-tiller:2.16.12:libcurl4-7.60.0-150000.33.1 Container suse/sle15:15.0:libcurl4-7.60.0-150000.33.1 Container suse/sle15:15.1:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:libcurl4-7.60.0-150000.33.1 SUSE Enterprise Storage 6:curl-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl-devel-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl4-32bit-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-7.60.0-150000.33.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222829-1/ https://www.suse.com/security/cve/CVE-2022-32206.html CVE-2022-32206 https://bugzilla.suse.com/1200735 SUSE Bug 1200735 https://bugzilla.suse.com/1207992 SUSE Bug 1207992 When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. CVE-2022-32208 Container caasp/v4/helm-tiller:2.16.12:libcurl4-7.60.0-150000.33.1 Container suse/sle15:15.0:libcurl4-7.60.0-150000.33.1 Container suse/sle15:15.1:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-Azure:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl4-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:curl-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:libcurl-devel-7.60.0-150000.33.1 Image SLES15-SP1-SAPCAL-GCE:libcurl4-7.60.0-150000.33.1 SUSE Enterprise Storage 6:curl-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl-devel-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl4-32bit-7.60.0-150000.33.1 SUSE Enterprise Storage 6:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:curl-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl-devel-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-32bit-7.60.0-150000.33.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-7.60.0-150000.33.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222829-1/ https://www.suse.com/security/cve/CVE-2022-32208.html CVE-2022-32208 https://bugzilla.suse.com/1200737 SUSE Bug 1200737