Headline
Ubuntu Security Notice USN-6718-1
Ubuntu Security Notice 6718-1 - Dan Fandrich discovered that curl would incorrectly use the default set of protocols when a parameter option disabled all protocols without adding any, contrary to expectations. This issue only affected Ubuntu 23.10. It was discovered that curl incorrectly handled memory when limiting the amount of headers when HTTP/2 server push is allowed. A remote attacker could possibly use this issue to cause curl to consume resources, leading to a denial of service.
==========================================================================
Ubuntu Security Notice USN-6718-1
March 27, 2024
curl vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in curl.
Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries
Details:
Dan Fandrich discovered that curl would incorrectly use the default set of
protocols when a parameter option disabled all protocols without adding
any, contrary to expectations. This issue only affected Ubuntu 23.10.
(CVE-2024-2004)
It was discovered that curl incorrectly handled memory when limiting the
amount of headers when HTTP/2 server push is allowed. A remote attacker
could possibly use this issue to cause curl to consume resources, leading
to a denial of service. (CVE-2024-2398)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
curl 8.2.1-1ubuntu3.3
libcurl3-gnutls 8.2.1-1ubuntu3.3
libcurl3-nss 8.2.1-1ubuntu3.3
libcurl4 8.2.1-1ubuntu3.3
Ubuntu 22.04 LTS:
curl 7.81.0-1ubuntu1.16
libcurl3-gnutls 7.81.0-1ubuntu1.16
libcurl3-nss 7.81.0-1ubuntu1.16
libcurl4 7.81.0-1ubuntu1.16
Ubuntu 20.04 LTS:
curl 7.68.0-1ubuntu2.22
libcurl3-gnutls 7.68.0-1ubuntu2.22
libcurl3-nss 7.68.0-1ubuntu2.22
libcurl4 7.68.0-1ubuntu2.22
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6718-1
CVE-2024-2004, CVE-2024-2398
Package Information:
https://launchpad.net/ubuntu/+source/curl/8.2.1-1ubuntu3.3
https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.16
https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.22
Related news
Red Hat Security Advisory 2024-7213-03 - Updated service-interconnect container images are now available for Service Interconnect 1.4 LTS for RHEL 9.
Gentoo Linux Security Advisory 202409-20 - Multiple vulnerabilities have been discovered in curl, the worst of which could lead to information disclosure. Versions greater than or equal to 8.7.1 are affected.
Red Hat Security Advisory 2024-3998-03 - An update for curl is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.
Ubuntu Security Notice 6718-3 - USN-6718-1 fixed vulnerabilities in curl. This update provides the corresponding updates for Ubuntu 24.04 LTS. Dan Fandrich discovered that curl would incorrectly use the default set of protocols when a parameter option disabled all protocols without adding any, contrary to expectations. This issue only affected Ubuntu 23.10. It was discovered that curl incorrectly handled memory when limiting the amount of headers when HTTP/2 server push is allowed. A remote attacker could possibly use this issue to cause curl to consume resources, leading to a denial of service.