what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2019-1880-01

Red Hat Security Advisory 2019-1880-01
Posted Jul 29, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-1880-01 - The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. An NTLM password overflow via integer overflow issue was addressed.

tags | advisory, web, overflow, protocol
systems | linux, redhat
advisories | CVE-2018-14618
SHA-256 | 7ff194be1ef6e345bac33f6db0c2870bd8420e769ad1819a796d665aa8b116e1

Red Hat Security Advisory 2019-1880-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Low: curl security and bug fix update
Advisory ID: RHSA-2019:1880-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2019:1880
Issue date: 2019-07-29
CVE Names: CVE-2018-14618
====================================================================
1. Summary:

An update for curl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x

3. Description:

The curl packages provide the libcurl library and the curl utility for
downloading files from servers using various protocols, including HTTP,
FTP, and LDAP.

Security Fix(es):

* curl: NTLM password overflow via integer overflow (CVE-2018-14618)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* baseurl with file:// hangs and then timeout in yum repo (BZ#1709474)

* curl crashes on http links with rate-limit (BZ#1711914)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1622707 - CVE-2018-14618 curl: NTLM password overflow via integer overflow
1709474 - baseurl with file:// hangs and then timeout in yum repo [rhel-7.6.z]

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
curl-7.29.0-51.el7_6.3.src.rpm

x86_64:
curl-7.29.0-51.el7_6.3.x86_64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-7.29.0-51.el7_6.3.i686.rpm
libcurl-7.29.0-51.el7_6.3.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-devel-7.29.0-51.el7_6.3.i686.rpm
libcurl-devel-7.29.0-51.el7_6.3.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
curl-7.29.0-51.el7_6.3.src.rpm

x86_64:
curl-7.29.0-51.el7_6.3.x86_64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-7.29.0-51.el7_6.3.i686.rpm
libcurl-7.29.0-51.el7_6.3.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

x86_64:
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-devel-7.29.0-51.el7_6.3.i686.rpm
libcurl-devel-7.29.0-51.el7_6.3.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
curl-7.29.0-51.el7_6.3.src.rpm

ppc64:
curl-7.29.0-51.el7_6.3.ppc64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.ppc.rpm
curl-debuginfo-7.29.0-51.el7_6.3.ppc64.rpm
libcurl-7.29.0-51.el7_6.3.ppc.rpm
libcurl-7.29.0-51.el7_6.3.ppc64.rpm
libcurl-devel-7.29.0-51.el7_6.3.ppc.rpm
libcurl-devel-7.29.0-51.el7_6.3.ppc64.rpm

ppc64le:
curl-7.29.0-51.el7_6.3.ppc64le.rpm
curl-debuginfo-7.29.0-51.el7_6.3.ppc64le.rpm
libcurl-7.29.0-51.el7_6.3.ppc64le.rpm
libcurl-devel-7.29.0-51.el7_6.3.ppc64le.rpm

s390x:
curl-7.29.0-51.el7_6.3.s390x.rpm
curl-debuginfo-7.29.0-51.el7_6.3.s390.rpm
curl-debuginfo-7.29.0-51.el7_6.3.s390x.rpm
libcurl-7.29.0-51.el7_6.3.s390.rpm
libcurl-7.29.0-51.el7_6.3.s390x.rpm
libcurl-devel-7.29.0-51.el7_6.3.s390.rpm
libcurl-devel-7.29.0-51.el7_6.3.s390x.rpm

x86_64:
curl-7.29.0-51.el7_6.3.x86_64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-7.29.0-51.el7_6.3.i686.rpm
libcurl-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-devel-7.29.0-51.el7_6.3.i686.rpm
libcurl-devel-7.29.0-51.el7_6.3.x86_64.rpm

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):

Source:
curl-7.29.0-51.el7_6.3.src.rpm

aarch64:
curl-7.29.0-51.el7_6.3.aarch64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.aarch64.rpm
libcurl-7.29.0-51.el7_6.3.aarch64.rpm
libcurl-devel-7.29.0-51.el7_6.3.aarch64.rpm

ppc64le:
curl-7.29.0-51.el7_6.3.ppc64le.rpm
curl-debuginfo-7.29.0-51.el7_6.3.ppc64le.rpm
libcurl-7.29.0-51.el7_6.3.ppc64le.rpm
libcurl-devel-7.29.0-51.el7_6.3.ppc64le.rpm

s390x:
curl-7.29.0-51.el7_6.3.s390x.rpm
curl-debuginfo-7.29.0-51.el7_6.3.s390.rpm
curl-debuginfo-7.29.0-51.el7_6.3.s390x.rpm
libcurl-7.29.0-51.el7_6.3.s390.rpm
libcurl-7.29.0-51.el7_6.3.s390x.rpm
libcurl-devel-7.29.0-51.el7_6.3.s390.rpm
libcurl-devel-7.29.0-51.el7_6.3.s390x.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
curl-7.29.0-51.el7_6.3.src.rpm

x86_64:
curl-7.29.0-51.el7_6.3.x86_64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-7.29.0-51.el7_6.3.i686.rpm
libcurl-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-devel-7.29.0-51.el7_6.3.i686.rpm
libcurl-devel-7.29.0-51.el7_6.3.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-14618
https://access.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXT8OSdzjgjWX9erEAQgkpw/9H1BB0gT4Hr2JCJQqmWyEwqKcGJbvn6Kk
KXSTXDzMthovBInO4kEjcnKyxZHNrvtQ+HoDr0e2SZNTEPehh35w7tJtiwzfYzc2
wk4K7cZiaRbYzCAnkH5SanFVPIJ7PbIgZZ7eoOtSHojvrysUvqFyXY04rIzw0CIS
MMFyg2Z5RCknnXDLtGHyRRcv6Ltxmp9uoQFW+IA5Zpn/Ppq8zFmuOTLjPe762Loc
4FzYIImeJ8F/CByxg9sKnyoWxgBiA3F9GYxXjur1S3NnmWwqIoeybuyVLr05FiIO
AfQ4lStJtiJZFWjgVVjJYeM9PS7Xc+q7A0prAxKQwXXedHAqA3uAUemwlGvNhqZg
WsTJ0EZDqYi0qU00L2sc4AW65FwDko0TV3Vyzd4kmmtOa3e8F19F119CQwtwodiA
lNX+V4JFoTo3+kMSO51TWK9Mu2bldEVKcLqqjohv83TQcAeFPPVcRePuv/O6FSdo
RUxhxpsf53r0welpd1mPvwvIEz/7m8m5OAmNiRziXm1s/2vhXzUjfbyEeOq0dmOY
dc7mHZ5snB3/QtmzWf/90DMe/wpI8IIU0u+9aP6oOTS0f3Blcvm1Z85mOrCQirEA
PTW4SMfBwQ0DUrt3zBaHiegThJMv2f2ivMnNGJW+P0rW24JRp0hMjbw1e1sFLptu
Xwo4DZx4tiI=2qw9
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

February 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    16 Files
  • 2
    Feb 2nd
    19 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    2 Files
  • 7
    Feb 7th
    10 Files
  • 8
    Feb 8th
    25 Files
  • 9
    Feb 9th
    37 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    20 Files
  • 14
    Feb 14th
    25 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    6 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    35 Files
  • 20
    Feb 20th
    25 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close