==========================================================================
Ubuntu Security Notice USN-4665-1
December 09, 2020
curl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 20.10
– Ubuntu 20.04 LTS
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in curl.
Software Description:
– curl: HTTP, HTTPS, and FTP client and client libraries
Details:
Marc Aldorasi discovered that curl incorrectly handled the libcurl
CURLOPT_CONNECT_ONLY option. This could result in data being sent to the
wrong destination, possibly exposing sensitive information. This issue only
affected Ubuntu 20.10. (CVE-2020-8231)
Varnavas Papaioannou discovered that curl incorrectly handled FTP PASV
responses. An attacker could possibly use this issue to trick curl into
connecting to an arbitrary IP address and be used to perform port scanner
and other information gathering. (CVE-2020-8284)
It was discovered that curl incorrectly handled FTP wildcard matchins. A
remote attacker could possibly use this issue to cause curl to consume
resources and crash, resulting in a denial of service. (CVE-2020-8285)
It was discovered that curl incorrectly handled OCSP response verification.
A remote attacker could possibly use this issue to provide a fraudulent
OCSP response. (CVE-2020-8286)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
curl 7.68.0-1ubuntu4.2
libcurl3-gnutls 7.68.0-1ubuntu4.2
libcurl3-nss 7.68.0-1ubuntu4.2
libcurl4 7.68.0-1ubuntu4.2
Ubuntu 20.04 LTS:
curl 7.68.0-1ubuntu2.4
libcurl3-gnutls 7.68.0-1ubuntu2.4
libcurl3-nss 7.68.0-1ubuntu2.4
libcurl4 7.68.0-1ubuntu2.4
Ubuntu 18.04 LTS:
curl 7.58.0-2ubuntu3.12
libcurl3-gnutls 7.58.0-2ubuntu3.12
libcurl3-nss 7.58.0-2ubuntu3.12
libcurl4 7.58.0-2ubuntu3.12
Ubuntu 16.04 LTS:
curl 7.47.0-1ubuntu2.18
libcurl3 7.47.0-1ubuntu2.18
libcurl3-gnutls 7.47.0-1ubuntu2.18
libcurl3-nss 7.47.0-1ubuntu2.18
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4665-1
CVE-2020-8231, CVE-2020-8284, CVE-2020-8285, CVE-2020-8286
Package Information:
https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu4.2
https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.4
https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.12
https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.18
—–BEGIN PGP SIGNATURE—–
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl/Q0AwACgkQZWnYVadE
vpPjnw//XwgNDWY4Bg9cWX+vT2cvUB8GmG9xcniKY4LfJMkcUgAKMlqMDLaIQrQx
tgJo9WCKNJzjI1r4w8f19gQuT3fElwedwshHVYOxYgGGW7Q0M0Tl+4OJ2va6ZQNj
Pb0Xbt00rZ0Cn/LFYQGYshaR4dleIrSjg/AI3jiKSYtObe86VlJ99HikqXpk7ps+
L2gjPoXXW3wvvQugEgJm4pHBgo4xg8II65OAFpKI9Pc/VfKOppV9TS6i59FUW1fB
Ok3jEVh4lFh4h8BHYQHTdw7IVLrfONAlZD0gF0DnTGImYLtYH9byJfpxbaP2SXct
scSkao28g2A/Jx807FTOEIKfk0azwhjwkxexS8hQglUEeVu3ehAqkxgTMg/fvokw
aWphl8YKiMvvUBrZ3/I0X24BO/FZZrflYfHGauIGWbFBayuVCq985f4zit45RT3l
8TiekBQx1pUWrLO3aux9t8yWcgwzWnmRIoSOUrZmUteEXSQgMFhNpGqNolUbmhpG
khI6Qbojxata/68e+B1mef+z/Va34PbtG6+Q5xGM3uG5JHMRFj4YMG/32sjOh59B
QF7P5Dq3dQVWbd3/JT0DqWdFxcvlmAMd03p6jbxDIyyMFdTNXlegdVy/7dVO/3Rr
1yj9ja5ySsYv2TKVjksTrtbJWA+pKmB7QcyM1saulbWVG3Ovqms=
=zcv3
—–END PGP SIGNATURE—–
—
