what you don't know can hurt you

Ubuntu Security Notice USN-4898-1

Ubuntu Security Notice USN-4898-1
Posted Mar 31, 2021
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4898-1 - Viktor Szakats discovered that curl did not strip off user credentials from referrer header fields. A remote attacker could possibly use this issue to obtain sensitive information. Mingtao Yang discovered that curl incorrectly handled session tickets when using an HTTPS proxy. A remote attacker in control of an HTTPS proxy could use this issue to bypass certificate checks and intercept communications. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. Various other issues were also addressed.

tags | advisory, remote, web
systems | linux, ubuntu
advisories | CVE-2021-22876, CVE-2021-22890
MD5 | 231654afdd07d6769fa7452e76aff9ab

Ubuntu Security Notice USN-4898-1

Change Mirror Download
==========================================================================
Ubuntu Security Notice USN-4898-1
March 31, 2021

curl vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

curl could be made to expose sensitive information over the network.

Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Viktor Szakats discovered that curl did not strip off user credentials
from referrer header fields. A remote attacker could possibly use this
issue to obtain sensitive information. (CVE-2021-22876)

Mingtao Yang discovered that curl incorrectly handled session tickets when
using an HTTPS proxy. A remote attacker in control of an HTTPS proxy could
use this issue to bypass certificate checks and intercept communications.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10.
(CVE-2021-22890)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
curl 7.68.0-1ubuntu4.3
libcurl3-gnutls 7.68.0-1ubuntu4.3
libcurl3-nss 7.68.0-1ubuntu4.3
libcurl4 7.68.0-1ubuntu4.3

Ubuntu 20.04 LTS:
curl 7.68.0-1ubuntu2.5
libcurl3-gnutls 7.68.0-1ubuntu2.5
libcurl3-nss 7.68.0-1ubuntu2.5
libcurl4 7.68.0-1ubuntu2.5

Ubuntu 18.04 LTS:
curl 7.58.0-2ubuntu3.13
libcurl3-gnutls 7.58.0-2ubuntu3.13
libcurl3-nss 7.58.0-2ubuntu3.13
libcurl4 7.58.0-2ubuntu3.13

Ubuntu 16.04 LTS:
curl 7.47.0-1ubuntu2.19
libcurl3 7.47.0-1ubuntu2.19
libcurl3-gnutls 7.47.0-1ubuntu2.19
libcurl3-nss 7.47.0-1ubuntu2.19

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-4898-1
CVE-2021-22876, CVE-2021-22890

Package Information:
https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu4.3
https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.5
https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.13
https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.19
Login or Register to add favorites

File Archive:

April 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    17 Files
  • 2
    Apr 2nd
    2 Files
  • 3
    Apr 3rd
    2 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    15 Files
  • 7
    Apr 7th
    20 Files
  • 8
    Apr 8th
    16 Files
  • 9
    Apr 9th
    5 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    4 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close