FEDORA-2022-39688a779d — security update for curl

stable

curl-7.79.1-7.fc35

FEDORA-2022-39688a779d created by kdudka 3 years ago for Fedora 35

url: use IDN decoded names for HSTS checks (CVE-2022-42916)
http_proxy: restore the protocol pointer on error (CVE-2022-42915)
netrc: replace fgets with Curl_get_line (CVE-2022-35260)
fix POST following PUT confusion (CVE-2022-32221)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2022-39688a779d

This update has been submitted for testing by kdudka.

3 years ago

This update's test gating status has been changed to 'waiting'.

3 years ago

This update's test gating status has been changed to 'passed'.

3 years ago

This update has been pushed to testing.

3 years ago

kdudka edited this update.

3 years ago

This update has been submitted for stable by bodhi.

3 years ago

This update has been pushed to stable.

3 years ago

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

passed

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

14 days

Dates

submitted

3 years ago

in testing

3 years ago

in stable

3 years ago

modified

3 years ago

Builds

curl-7.79.1-7.fc35

BZ#2137769 CVE-2022-42916 curl: HSTS bypass via IDN [fedora-all]

BZ#2137780 CVE-2022-32221 curl: POST following PUT confusion [fedora-all]

BZ#2138111 CVE-2022-42915 curl: HTTP proxy double-free [fedora-all]

curl-7.79.1-7.fc35

Automated Test Results

passed