-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 26 Jan 2023 08:47:05 -0500 Source: curl Architecture: source Version: 7.64.0-4+deb10u4 Distribution: buster-security Urgency: high Maintainer: Alessandro Ghedini <ghedo@debian.org> Changed-By: Roberto C. Sánchez <roberto@debian.org> Changes: curl (7.64.0-4+deb10u4) buster-security; urgency=high . * Non-maintainer upload by the LTS Team. * CVE-2022-27774: An insufficiently protected credentials vulnerability exists in curl that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers. * Follow up to CVE-2022-27782: The patch included to address this CVE in 7.64.0-4+deb10u3 contained a defect which resulted in the vulnerability being completely addressed. The patch is corrected and the vulberability is fully addressed in this version. * CVE-2022-32221: When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. * CVE-2022-35252: When curl is used to retrieve and parse cookies from a HTTP(S) server, it accepts cookies using control codes that when later are sent back to a HTTP server might make the server return 400 responses. Effectively allowing a "sister site" to deny service to all siblings. * CVE-2022-43552: HTTP Proxy deny use-after-free Checksums-Sha1: 8d2bdc1b1be2e0902b6892b15789b7201345013f 2694 curl_7.64.0-4+deb10u4.dsc 91cbf9870fe086bbb8057ae3e2342fc6462913bf 59080 curl_7.64.0-4+deb10u4.debian.tar.xz 66ba73edc78da52619c83ba099e855475bb78125 11810 curl_7.64.0-4+deb10u4_amd64.buildinfo Checksums-Sha256: ba385d7f1468f4bf309642218433f4975b9d5606410941bce7382b8cddebc273 2694 curl_7.64.0-4+deb10u4.dsc a6a0f1c45359fa262ae1612e9d3d3e185c88b4d87473e44557bcc0441a72f10c 59080 curl_7.64.0-4+deb10u4.debian.tar.xz e0013362ab8237ce14273d268f74c6a7125647830e3a95009580cb82ee611117 11810 curl_7.64.0-4+deb10u4_amd64.buildinfo Files: a1a433d9fbd4cebf9ca87f42a07d0dba 2694 web optional curl_7.64.0-4+deb10u4.dsc f339698607d0ba7a918fdf2c00375338 59080 web optional curl_7.64.0-4+deb10u4.debian.tar.xz 52783a1817d2b9c49126d11811b16d2b 11810 web optional curl_7.64.0-4+deb10u4_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEIYZ1DR4ae5UL01q7ldFmTdL1kUIFAmPVhGgACgkQldFmTdL1 kUI4fg/6ApuNKC6jw9UxuE0JNezK/Zk1Kb3gWkN6lOwuizlflBS6InVZeLEFtRDB /L2mMw/XUMMtUweBq38ZD3Xv9ROavKZB9n7CHbBOx6SFUBrhKfc9tGFdluvGlNlk pwdG/KRqcqnKJ5yxXx9dEFgC3aKDjCDVs92jMI4zSmTUoXbFNXr+URATybrl+X2d ao1avKPyh1Qvn4OAKkSEX2MoXyegzoWIm7/Kf6+TrkbCzmBjx6nniYd7nwnRARP2 ECYTSBHgA/PScGab0Sth30BGh3wnC+Bzr2mWj9SsO+fOP5i0FHG+ZSD9DpwbdFD1 JErexcCHaWh0/GfrP4KVOxvzJXHc2hAMEzgDxojoOzxJDG3CMRb+FhknklBM/CJb nNnGKZjcLT/hUKKzwWBYaP3+l7RW1ArG0/izOVPs/Iw3q9MxfJMZjJCLL9RlOQYu MbuC+K6ML9UHaH5QuIxgn9ySyMjwNK2BbAwawweQAza9G6v/wD2cc3gRXBPGj2Cy RJQc4YUfz2hfHjxXwcXIOfLbm2OOf6UJewQRekWWjVo0QC2973rvlgw/3wvccuGL FmNfS52tC5qGKU4b7sCG+9UYB8DZtHFetU5RUse+0iY7TxBK2UvwuRrIQDr8hTK7 XrSJZG0FhmpZ6cJh06LUS5X/+uFO6u6cdw+zzaiRGQMl6o5AZkA= =QVbv -----END PGP SIGNATURE-----
