Issued:
2021-11-09
Updated:
2021-11-09

RHSA-2021:4511 - Security Advisory

Synopsis

Moderate: curl security and bug fix update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for curl is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)
  • curl: TELNET stack contents disclosure (CVE-2021-22898)
  • curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1941964 - CVE-2021-22876 curl: Leak of authentication credentials in URL via automatic Referer
  • BZ - 1947493 - Why there is a difference between curl --head output on the RHEL7 and RHEL8.
  • BZ - 1964887 - CVE-2021-22898 curl: TELNET stack contents disclosure
  • BZ - 1970902 - CVE-2021-22925 curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure

Red Hat Enterprise Linux for x86_64 8

SRPM
curl-7.61.1-22.el8.src.rpm SHA-256: e90257592999e41299819dc4c46fecf1796f2e14d8b444d08e7391969293cde5
x86_64
curl-7.61.1-22.el8.x86_64.rpm SHA-256: cc60605cd4164fccd1f6b5cb07d29b55d878e1b50163be076f506eefdf46f595
curl-debuginfo-7.61.1-22.el8.i686.rpm SHA-256: 00df4572077787baf1545d66e2c239045ea3b7d0cfb71727038be87a8f29a913
curl-debuginfo-7.61.1-22.el8.x86_64.rpm SHA-256: 06052979bf070a4ecd985cc3da69f200a3d541879191a3105dae338184f64a16
curl-debugsource-7.61.1-22.el8.i686.rpm SHA-256: 53c0848017b361fb398cd57b178e369d5ca3664f9ecbdd534e445c5a6edf4b44
curl-debugsource-7.61.1-22.el8.x86_64.rpm SHA-256: 9aba718940dc5b7fefa63526d1e82c3943178280510714535881439d994cbfc5
curl-minimal-debuginfo-7.61.1-22.el8.i686.rpm SHA-256: 7759a808e00e5e38fe4bc713dbf70cf98a51d1ea550a56df6cc12cb5702be3c7
curl-minimal-debuginfo-7.61.1-22.el8.x86_64.rpm SHA-256: d487c9ff2f63215e93e72fe016956300cbee89799178a98d4e897e5433f2b430
libcurl-7.61.1-22.el8.i686.rpm SHA-256: 710bfdde260c08b177db1cd8972516d0087547e9e58a1ab7d10510927eff3a54
libcurl-7.61.1-22.el8.x86_64.rpm SHA-256: 57ec379830cbfb310ae02166b02768a042fb06c888d56bfc89736298187c5ae3
libcurl-debuginfo-7.61.1-22.el8.i686.rpm SHA-256: 0a605c912b01dec7dd5de51aa3ddf3c9c5500587a5ea59870f636f1aca480719
libcurl-debuginfo-7.61.1-22.el8.x86_64.rpm SHA-256: 783fcb69a9a7908a60f19aa1f59b4bfb4fc585bbe7a7db263e2bd5a11e99e790
libcurl-devel-7.61.1-22.el8.i686.rpm SHA-256: 1ce716bae7089580068d2a9f245371acec0dbb7fe484795f7c04f90f4fc21613
libcurl-devel-7.61.1-22.el8.x86_64.rpm SHA-256: 12235a11f00e273d6ae0b9a859b64ec9b674d20148cc80e924833f81c384628b
libcurl-minimal-7.61.1-22.el8.i686.rpm SHA-256: 52178388f11b9fde868f8cf559c78d4686ac4658a0621530be8ab09df0393972
libcurl-minimal-7.61.1-22.el8.x86_64.rpm SHA-256: cba793d95d7b7646a59dcee14e74eb0aceed1890635f31f4d899f54d476a3f29
libcurl-minimal-debuginfo-7.61.1-22.el8.i686.rpm SHA-256: c2b7f9fa4db8adf87f1fde445c10f2dbbc36a75c54e70ced8bf7b399ef91f923
libcurl-minimal-debuginfo-7.61.1-22.el8.x86_64.rpm SHA-256: b7f0d8bf1b1d4755571be6934dcaf516c2b8ee2de402f023c0b9ca17568bf9f6

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
curl-7.61.1-22.el8.src.rpm SHA-256: e90257592999e41299819dc4c46fecf1796f2e14d8b444d08e7391969293cde5
s390x
curl-7.61.1-22.el8.s390x.rpm SHA-256: d5fb76c946051587b65b198ae558a18ab7222f998d794fb5d53911af07654cca
curl-debuginfo-7.61.1-22.el8.s390x.rpm SHA-256: 125ef0c8821e6537f0dbb884907a8d95a51ce3d6163a0df4c35275ffcae4e3a2
curl-debugsource-7.61.1-22.el8.s390x.rpm SHA-256: 08c24f72a765406dd7eebc998926ea1991c1204c043b0396262d0d43135e6fdb
curl-minimal-debuginfo-7.61.1-22.el8.s390x.rpm SHA-256: 9e75183abe5fd94952c02df8e0a2e5601e63d0556cbd8339d79b56df660930b7
libcurl-7.61.1-22.el8.s390x.rpm SHA-256: 7ff87cbbea952d0b108f5bcba41724ab38b1f9dcbfe03f14d4ddac26b60cb28c
libcurl-debuginfo-7.61.1-22.el8.s390x.rpm SHA-256: 06193fbad4e2d39b0dd031131643c2468a159478fc800aa7e297e583d44e42a9
libcurl-devel-7.61.1-22.el8.s390x.rpm SHA-256: 694376bb4a99b0a906720d5aa44934ebf8fbae0f9c57b4280686b23c3f817c9c
libcurl-minimal-7.61.1-22.el8.s390x.rpm SHA-256: ee6d15f99005fcce4efbe284a763fde0ef5dbf2a23691e0c4c3aec666f9096c2
libcurl-minimal-debuginfo-7.61.1-22.el8.s390x.rpm SHA-256: 434696dd13496f54d40921db7b0ca789a6834139f3a27de0cf2b1835cf4d1a04

Red Hat Enterprise Linux for Power, little endian 8

SRPM
curl-7.61.1-22.el8.src.rpm SHA-256: e90257592999e41299819dc4c46fecf1796f2e14d8b444d08e7391969293cde5
ppc64le
curl-7.61.1-22.el8.ppc64le.rpm SHA-256: 56d793fdc9bb96eaa666a15ad63a57dc76e6ead1c13cdf1e7a46401ed0cb3346
curl-debuginfo-7.61.1-22.el8.ppc64le.rpm SHA-256: 7d700eba4d8c5cf888ec3c701943c8201ea15b504bf3b687a73f1164a78447d8
curl-debugsource-7.61.1-22.el8.ppc64le.rpm SHA-256: 65c5d56c78fca49ad847c11cc1696d310e667be5e21f5d3223cd317a4987b946
curl-minimal-debuginfo-7.61.1-22.el8.ppc64le.rpm SHA-256: 8275452aa2715182d4071d0d58486f7b953e3c75636efb31e2c696dcf71ff3d3
libcurl-7.61.1-22.el8.ppc64le.rpm SHA-256: 19cea53697bfe8b119d5287cd23025a7d52afed7faaa8fa8f7ef9e0b7d18558d
libcurl-debuginfo-7.61.1-22.el8.ppc64le.rpm SHA-256: 511d7f24b006312a990d6c77698afc0f96000d5fa5d6ffa07be9e55db962b1ad
libcurl-devel-7.61.1-22.el8.ppc64le.rpm SHA-256: cb837bb7995fd39d24052fafe83f9df87e26b644d3b7e78b35863d69136a9640
libcurl-minimal-7.61.1-22.el8.ppc64le.rpm SHA-256: b360957494c0091dfaa08386bed339279056011bd5a06b71f82d639301d52dec
libcurl-minimal-debuginfo-7.61.1-22.el8.ppc64le.rpm SHA-256: a214a1b39a74816110d1724c157fde38e80a3eab966ecc933b2f11bdc8f9fd0a

Red Hat Enterprise Linux for ARM 64 8

SRPM
curl-7.61.1-22.el8.src.rpm SHA-256: e90257592999e41299819dc4c46fecf1796f2e14d8b444d08e7391969293cde5
aarch64
curl-7.61.1-22.el8.aarch64.rpm SHA-256: 12d6bfe52608f37a92a73b84330c66324ea981df4c6e940cc59fe835cbc4164e
curl-debuginfo-7.61.1-22.el8.aarch64.rpm SHA-256: e81ee25bebd628c7119d4d483b53e4ca64d2a24854945f50bf56edb3f58ce7c2
curl-debugsource-7.61.1-22.el8.aarch64.rpm SHA-256: c168f1e071298c19b3777a704a27d400965800ba0072143a4647b2f2fe2455a1
curl-minimal-debuginfo-7.61.1-22.el8.aarch64.rpm SHA-256: e7f643c4e9ef807068abb9d45cd06b858c50fcbda160d4a477272c0971a0acd8
libcurl-7.61.1-22.el8.aarch64.rpm SHA-256: db7b9e20c46bd33f0d25e2952ef4bed5a3dce3e37767594927c57c167cf0e69f
libcurl-debuginfo-7.61.1-22.el8.aarch64.rpm SHA-256: 6d3badecc728a2275de6bf2a097fff7d0959953df36d5843e31ca524f35bc0e5
libcurl-devel-7.61.1-22.el8.aarch64.rpm SHA-256: 5c0fd1abc3056fa8cfc42721f320eb34ddb8dfb451d6b55ef78e8cd638eb03cf
libcurl-minimal-7.61.1-22.el8.aarch64.rpm SHA-256: c0cc8c6dff5aa35aa92b30c3f5045efa2fed30583725f9b1e1ffcff6299f0027
libcurl-minimal-debuginfo-7.61.1-22.el8.aarch64.rpm SHA-256: 792dc16aaf00d990dd54422b4ea2e50f452ee13baa49dfabd08c4c0b77c4677f

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.