Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3774-1 Final 1 1 2022-10-26T10:21:39Z current 2022-10-26T10:21:39Z 2022-10-26T10:21:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: - CVE-2022-32221: Fixed POST following PUT confusion (bsc#1204383). - CVE-2022-35252: Fixed a potential injection of control characters into cookies (bsc#1202593). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container caasp/v4/helm-tiller:2.16.12-2022-3774,Container suse/sle15:15.0-2022-3774,Container suse/sle15:15.1-2022-3774,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2022-3774,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2022-3774,Image SLES15-SP1-SAPCAL-Azure-2022-3774,Image SLES15-SP1-SAPCAL-EC2-HVM-2022-3774,Image SLES15-SP1-SAPCAL-GCE-2022-3774,SUSE-2022-3774,SUSE-SLE-Product-HPC-15-2022-3774,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3774,SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3774,SUSE-SLE-Product-SLES-15-2022-3774,SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3774,SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3774,SUSE-SLE-Product-SLES_SAP-15-2022-3774,SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3774,SUSE-Storage-6-2022-3774 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223774-1/ Link for SUSE-SU-2022:3774-1 https://lists.suse.com/pipermail/sle-security-updates/2022-October/012702.html E-Mail link for SUSE-SU-2022:3774-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1202593 SUSE Bug 1202593 https://bugzilla.suse.com/1204383 SUSE Bug 1204383 https://www.suse.com/security/cve/CVE-2022-32221/ SUSE CVE CVE-2022-32221 page https://www.suse.com/security/cve/CVE-2022-35252/ SUSE CVE CVE-2022-35252 page Container caasp/v4/helm-tiller:2.16.12 Container suse/sle15:15.0 Container suse/sle15:15.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP1-SAPCAL-Azure Image SLES15-SP1-SAPCAL-EC2-HVM Image SLES15-SP1-SAPCAL-GCE SUSE Enterprise Storage 6 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15 SP1-BCL SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl4-7.60.0-150000.38.1 curl-7.60.0-150000.38.1 libcurl-devel-7.60.0-150000.38.1 curl-mini-7.60.0-150000.38.1 libcurl-devel-32bit-7.60.0-150000.38.1 libcurl-devel-64bit-7.60.0-150000.38.1 libcurl-mini-devel-7.60.0-150000.38.1 libcurl4-32bit-7.60.0-150000.38.1 libcurl4-64bit-7.60.0-150000.38.1 libcurl4-mini-7.60.0-150000.38.1 libcurl4-7.60.0-150000.38.1 as a component of Container caasp/v4/helm-tiller:2.16.12 libcurl4-7.60.0-150000.38.1 as a component of Container suse/sle15:15.0 libcurl4-7.60.0-150000.38.1 as a component of Container suse/sle15:15.1 curl-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production libcurl4-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production curl-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production libcurl4-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production curl-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAPCAL-Azure libcurl-devel-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAPCAL-Azure libcurl4-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAPCAL-Azure curl-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM libcurl-devel-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM libcurl4-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM curl-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAPCAL-GCE libcurl-devel-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAPCAL-GCE libcurl4-7.60.0-150000.38.1 as a component of Image SLES15-SP1-SAPCAL-GCE curl-7.60.0-150000.38.1 as a component of SUSE Enterprise Storage 6 libcurl-devel-7.60.0-150000.38.1 as a component of SUSE Enterprise Storage 6 libcurl4-7.60.0-150000.38.1 as a component of SUSE Enterprise Storage 6 libcurl4-32bit-7.60.0-150000.38.1 as a component of SUSE Enterprise Storage 6 curl-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libcurl-devel-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libcurl4-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libcurl4-32bit-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS curl-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libcurl-devel-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libcurl4-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libcurl4-32bit-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS curl-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libcurl-devel-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libcurl4-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libcurl4-32bit-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS curl-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libcurl-devel-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libcurl4-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libcurl4-32bit-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS curl-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL libcurl-devel-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL libcurl4-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL libcurl4-32bit-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL curl-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libcurl-devel-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libcurl4-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libcurl4-32bit-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS curl-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15-LTSS libcurl-devel-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15-LTSS libcurl4-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15-LTSS libcurl4-32bit-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server 15-LTSS curl-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libcurl-devel-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libcurl4-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libcurl4-32bit-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 curl-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl-devel-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl4-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl4-32bit-7.60.0-150000.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST. CVE-2022-32221 Container caasp/v4/helm-tiller:2.16.12:libcurl4-7.60.0-150000.38.1 Container suse/sle15:15.0:libcurl4-7.60.0-150000.38.1 Container suse/sle15:15.1:libcurl4-7.60.0-150000.38.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:curl-7.60.0-150000.38.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-150000.38.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-150000.38.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-Azure:curl-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-Azure:libcurl-devel-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-Azure:libcurl4-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-EC2-HVM:curl-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl-devel-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl4-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-GCE:curl-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-GCE:libcurl-devel-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-GCE:libcurl4-7.60.0-150000.38.1 SUSE Enterprise Storage 6:curl-7.60.0-150000.38.1 SUSE Enterprise Storage 6:libcurl-devel-7.60.0-150000.38.1 SUSE Enterprise Storage 6:libcurl4-32bit-7.60.0-150000.38.1 SUSE Enterprise Storage 6:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-BCL:curl-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-LTSS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15-LTSS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15-LTSS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:curl-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15:curl-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-7.60.0-150000.38.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223774-1/ https://www.suse.com/security/cve/CVE-2022-32221.html CVE-2022-32221 https://bugzilla.suse.com/1204383 SUSE Bug 1204383 https://bugzilla.suse.com/1205287 SUSE Bug 1205287 https://bugzilla.suse.com/1205834 SUSE Bug 1205834 https://bugzilla.suse.com/1206236 SUSE Bug 1206236 https://bugzilla.suse.com/1208340 SUSE Bug 1208340 https://bugzilla.suse.com/1211233 SUSE Bug 1211233 When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings. CVE-2022-35252 Container caasp/v4/helm-tiller:2.16.12:libcurl4-7.60.0-150000.38.1 Container suse/sle15:15.0:libcurl4-7.60.0-150000.38.1 Container suse/sle15:15.1:libcurl4-7.60.0-150000.38.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:curl-7.60.0-150000.38.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-150000.38.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-150000.38.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-Azure:curl-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-Azure:libcurl-devel-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-Azure:libcurl4-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-EC2-HVM:curl-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl-devel-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-EC2-HVM:libcurl4-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-GCE:curl-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-GCE:libcurl-devel-7.60.0-150000.38.1 Image SLES15-SP1-SAPCAL-GCE:libcurl4-7.60.0-150000.38.1 SUSE Enterprise Storage 6:curl-7.60.0-150000.38.1 SUSE Enterprise Storage 6:libcurl-devel-7.60.0-150000.38.1 SUSE Enterprise Storage 6:libcurl4-32bit-7.60.0-150000.38.1 SUSE Enterprise Storage 6:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-BCL:curl-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-BCL:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-LTSS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15-LTSS:curl-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15-LTSS:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise Server 15-LTSS:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:curl-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15:curl-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl-devel-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-32bit-7.60.0-150000.38.1 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-7.60.0-150000.38.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223774-1/ https://www.suse.com/security/cve/CVE-2022-35252.html CVE-2022-35252 https://bugzilla.suse.com/1202593 SUSE Bug 1202593