rhsa-2020_0594
Vulnerability from csaf_redhat
Published
2020-02-25 12:14
Modified
2024-09-13 16:58
Summary
Red Hat Security Advisory: curl security update
Notes
Topic
An update for curl is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
* curl: HTTP authentication leak in redirects (CVE-2018-1000007)
* curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)
* curl: RTSP RTP buffer over-read (CVE-2018-1000122)
* curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service (CVE-2018-1000301)
* curl: LDAP NULL pointer dereference (CVE-2018-1000121)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for curl is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: HTTP authentication leak in redirects (CVE-2018-1000007)\n\n* curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)\n\n* curl: RTSP RTP buffer over-read (CVE-2018-1000122)\n\n* curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service (CVE-2018-1000301)\n\n* curl: LDAP NULL pointer dereference (CVE-2018-1000121)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:0594",
"url": "https://access.redhat.com/errata/RHSA-2020:0594"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1537125",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1537125"
},
{
"category": "external",
"summary": "1552628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1552628"
},
{
"category": "external",
"summary": "1552631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1552631"
},
{
"category": "external",
"summary": "1553398",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553398"
},
{
"category": "external",
"summary": "1575536",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575536"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2020/rhsa-2020_0594.json"
}
],
"title": "Red Hat Security Advisory: curl security update",
"tracking": {
"current_release_date": "2024-09-13T16:58:55+00:00",
"generator": {
"date": "2024-09-13T16:58:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2020:0594",
"initial_release_date": "2020-02-25T12:14:24+00:00",
"revision_history": [
{
"date": "2020-02-25T12:14:24+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-02-25T12:14:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-13T16:58:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server AUS (v. 7.4)",
"product": {
"name": "Red Hat Enterprise Linux Server AUS (v. 7.4)",
"product_id": "7Server-7.4.AUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_aus:7.4::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product": {
"name": "Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_e4s:7.4::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server TUS (v. 7.4)",
"product": {
"name": "Red Hat Enterprise Linux Server TUS (v. 7.4)",
"product_id": "7Server-7.4.TUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_tus:7.4::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:7.29.0-42.el7_4.2.x86_64",
"product": {
"name": "curl-0:7.29.0-42.el7_4.2.x86_64",
"product_id": "curl-0:7.29.0-42.el7_4.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@7.29.0-42.el7_4.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libcurl-0:7.29.0-42.el7_4.2.x86_64",
"product": {
"name": "libcurl-0:7.29.0-42.el7_4.2.x86_64",
"product_id": "libcurl-0:7.29.0-42.el7_4.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl@7.29.0-42.el7_4.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"product": {
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"product_id": "libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-devel@7.29.0-42.el7_4.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"product": {
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"product_id": "curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl-debuginfo@7.29.0-42.el7_4.2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libcurl-0:7.29.0-42.el7_4.2.i686",
"product": {
"name": "libcurl-0:7.29.0-42.el7_4.2.i686",
"product_id": "libcurl-0:7.29.0-42.el7_4.2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl@7.29.0-42.el7_4.2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"product": {
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"product_id": "libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-devel@7.29.0-42.el7_4.2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"product": {
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"product_id": "curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl-debuginfo@7.29.0-42.el7_4.2?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:7.29.0-42.el7_4.2.src",
"product": {
"name": "curl-0:7.29.0-42.el7_4.2.src",
"product_id": "curl-0:7.29.0-42.el7_4.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@7.29.0-42.el7_4.2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:7.29.0-42.el7_4.2.ppc64le",
"product": {
"name": "curl-0:7.29.0-42.el7_4.2.ppc64le",
"product_id": "curl-0:7.29.0-42.el7_4.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@7.29.0-42.el7_4.2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"product": {
"name": "libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"product_id": "libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl@7.29.0-42.el7_4.2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"product": {
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"product_id": "libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-devel@7.29.0-42.el7_4.2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"product": {
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"product_id": "curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl-debuginfo@7.29.0-42.el7_4.2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:7.29.0-42.el7_4.2.src as a component of Red Hat Enterprise Linux Server AUS (v. 7.4)",
"product_id": "7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src"
},
"product_reference": "curl-0:7.29.0-42.el7_4.2.src",
"relates_to_product_reference": "7Server-7.4.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.4)",
"product_id": "7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "curl-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.i686 as a component of Red Hat Enterprise Linux Server AUS (v. 7.4)",
"product_id": "7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686"
},
"product_reference": "curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"relates_to_product_reference": "7Server-7.4.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.4)",
"product_id": "7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:7.29.0-42.el7_4.2.i686 as a component of Red Hat Enterprise Linux Server AUS (v. 7.4)",
"product_id": "7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686"
},
"product_reference": "libcurl-0:7.29.0-42.el7_4.2.i686",
"relates_to_product_reference": "7Server-7.4.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.4)",
"product_id": "7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "libcurl-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.i686 as a component of Red Hat Enterprise Linux Server AUS (v. 7.4)",
"product_id": "7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686"
},
"product_reference": "libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"relates_to_product_reference": "7Server-7.4.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.4)",
"product_id": "7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:7.29.0-42.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le"
},
"product_reference": "curl-0:7.29.0-42.el7_4.2.ppc64le",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:7.29.0-42.el7_4.2.src as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src"
},
"product_reference": "curl-0:7.29.0-42.el7_4.2.src",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "curl-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.i686 as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686"
},
"product_reference": "curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le"
},
"product_reference": "curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:7.29.0-42.el7_4.2.i686 as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686"
},
"product_reference": "libcurl-0:7.29.0-42.el7_4.2.i686",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:7.29.0-42.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le"
},
"product_reference": "libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "libcurl-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.i686 as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686"
},
"product_reference": "libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le"
},
"product_reference": "libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server E4S (v. 7.4)",
"product_id": "7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:7.29.0-42.el7_4.2.src as a component of Red Hat Enterprise Linux Server TUS (v. 7.4)",
"product_id": "7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src"
},
"product_reference": "curl-0:7.29.0-42.el7_4.2.src",
"relates_to_product_reference": "7Server-7.4.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server TUS (v. 7.4)",
"product_id": "7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "curl-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.i686 as a component of Red Hat Enterprise Linux Server TUS (v. 7.4)",
"product_id": "7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686"
},
"product_reference": "curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"relates_to_product_reference": "7Server-7.4.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server TUS (v. 7.4)",
"product_id": "7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:7.29.0-42.el7_4.2.i686 as a component of Red Hat Enterprise Linux Server TUS (v. 7.4)",
"product_id": "7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686"
},
"product_reference": "libcurl-0:7.29.0-42.el7_4.2.i686",
"relates_to_product_reference": "7Server-7.4.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server TUS (v. 7.4)",
"product_id": "7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "libcurl-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.i686 as a component of Red Hat Enterprise Linux Server TUS (v. 7.4)",
"product_id": "7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686"
},
"product_reference": "libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"relates_to_product_reference": "7Server-7.4.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:7.29.0-42.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server TUS (v. 7.4)",
"product_id": "7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
},
"product_reference": "libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.TUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Curl project"
]
},
{
"names": [
"Craig de Stigter"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2018-1000007",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2018-01-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1537125"
}
],
"notes": [
{
"category": "description",
"text": "It was found that curl and libcurl might send their Authentication header to a third party HTTP server upon receiving an HTTP REDIRECT reply. This could leak authentication token to external entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: HTTP authentication leak in redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of curl as shipped with Red Hat Enterprise Linux 5, 6, and 7, as well as the versions of httpd24-curl as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-1000007"
},
{
"category": "external",
"summary": "RHBZ#1537125",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1537125"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-1000007",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000007"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000007",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000007"
},
{
"category": "external",
"summary": "https://curl.haxx.se/docs/adv_2018-b3bf.html",
"url": "https://curl.haxx.se/docs/adv_2018-b3bf.html"
}
],
"release_date": "2018-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:0594"
},
{
"category": "workaround",
"details": "By default, curl and libcurl will not follow redirect requests.\nThis flaw happens only when curl or libcurl are explicitly requested to follow redirects (option --location in curl, and CURLOPT_FOLLOWLOCATION in libcurl).\nTo mitigate this, it is possible to prevent the automated following of redirects, replacing it by manual redirects (and remove the authentication header), for example.",
"product_ids": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: HTTP authentication leak in redirects"
},
{
"acknowledgments": [
{
"names": [
"the Curl project"
]
},
{
"names": [
"Duy Phan Thanh"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2018-1000120",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2018-03-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1552628"
}
],
"notes": [
{
"category": "description",
"text": "It was found that libcurl did not safely parse FTP URLs when using the CURLOPT_FTP_FILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash or an unspecified behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: FTP path trickery leads to NIL byte out of bounds write",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-1000120"
},
{
"category": "external",
"summary": "RHBZ#1552628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1552628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-1000120",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000120"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000120",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000120"
},
{
"category": "external",
"summary": "https://curl.haxx.se/docs/adv_2018-9cd6.html",
"url": "https://curl.haxx.se/docs/adv_2018-9cd6.html"
}
],
"release_date": "2018-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:0594"
},
{
"category": "workaround",
"details": "Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.",
"product_ids": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: FTP path trickery leads to NIL byte out of bounds write"
},
{
"acknowledgments": [
{
"names": [
"the Curl project"
]
},
{
"names": [
"Dario Weisser"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2018-1000121",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2018-03-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1552631"
}
],
"notes": [
{
"category": "description",
"text": "A NULL pointer dereference flaw was found in the way libcurl checks values returned by the openldap ldap_get_attribute_ber() function. A malicious LDAP server could use this flaw to crash a libcurl client application via a specially crafted LDAP reply.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: LDAP NULL pointer dereference",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-1000121"
},
{
"category": "external",
"summary": "RHBZ#1552631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1552631"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-1000121",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000121"
},
{
"category": "external",
"summary": "https://curl.haxx.se/docs/adv_2018-97a2.html",
"url": "https://curl.haxx.se/docs/adv_2018-97a2.html"
}
],
"release_date": "2018-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:0594"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: LDAP NULL pointer dereference"
},
{
"acknowledgments": [
{
"names": [
"the Curl project"
]
},
{
"names": [
"Max Dymond"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2018-1000122",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2018-03-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1553398"
}
],
"notes": [
{
"category": "description",
"text": "A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: RTSP RTP buffer over-read",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-1000122"
},
{
"category": "external",
"summary": "RHBZ#1553398",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553398"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-1000122",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000122"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000122",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000122"
},
{
"category": "external",
"summary": "https://curl.haxx.se/docs/adv_2018-b047.html",
"url": "https://curl.haxx.se/docs/adv_2018-b047.html"
}
],
"release_date": "2018-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:0594"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: RTSP RTP buffer over-read"
},
{
"acknowledgments": [
{
"names": [
"the Curl project"
]
},
{
"names": [
"the OSS-Fuzz project"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2018-1000301",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2018-05-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1575536"
}
],
"notes": [
{
"category": "description",
"text": "curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl \u003c 7.20.0 and curl \u003e= 7.60.0.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-1000301"
},
{
"category": "external",
"summary": "RHBZ#1575536",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575536"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-1000301",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000301"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000301",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000301"
},
{
"category": "external",
"summary": "https://curl.haxx.se/docs/adv_2018-b138.html",
"url": "https://curl.haxx.se/docs/adv_2018-b138.html"
}
],
"release_date": "2018-05-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:0594"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.AUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.AUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.E4S:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.ppc64le",
"7Server-7.4.E4S:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.src",
"7Server-7.4.TUS:curl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:curl-debuginfo-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-0:7.29.0-42.el7_4.2.x86_64",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.i686",
"7Server-7.4.TUS:libcurl-devel-0:7.29.0-42.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service"
}
]
}
Loading...