Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.2828
Low: curl security and bug fix update
30 July 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: cURL
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux WS/Desktop 7
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-14618
Reference: ESB-2019.1426
ESB-2019.1221
ESB-2018.2643
ESB-2018.2641
Original Bulletin:
https://access.redhat.com/errata/RHSA-2019:1880
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Low: curl security and bug fix update
Advisory ID: RHSA-2019:1880-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2019:1880
Issue date: 2019-07-29
CVE Names: CVE-2018-14618
=====================================================================
1. Summary:
An update for curl is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x
3. Description:
The curl packages provide the libcurl library and the curl utility for
downloading files from servers using various protocols, including HTTP,
FTP, and LDAP.
Security Fix(es):
* curl: NTLM password overflow via integer overflow (CVE-2018-14618)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* baseurl with file:// hangs and then timeout in yum repo (BZ#1709474)
* curl crashes on http links with rate-limit (BZ#1711914)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1622707 - CVE-2018-14618 curl: NTLM password overflow via integer overflow
1709474 - baseurl with file:// hangs and then timeout in yum repo [rhel-7.6.z]
6. Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
curl-7.29.0-51.el7_6.3.src.rpm
x86_64:
curl-7.29.0-51.el7_6.3.x86_64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-7.29.0-51.el7_6.3.i686.rpm
libcurl-7.29.0-51.el7_6.3.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64:
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-devel-7.29.0-51.el7_6.3.i686.rpm
libcurl-devel-7.29.0-51.el7_6.3.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
curl-7.29.0-51.el7_6.3.src.rpm
x86_64:
curl-7.29.0-51.el7_6.3.x86_64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-7.29.0-51.el7_6.3.i686.rpm
libcurl-7.29.0-51.el7_6.3.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64:
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-devel-7.29.0-51.el7_6.3.i686.rpm
libcurl-devel-7.29.0-51.el7_6.3.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
curl-7.29.0-51.el7_6.3.src.rpm
ppc64:
curl-7.29.0-51.el7_6.3.ppc64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.ppc.rpm
curl-debuginfo-7.29.0-51.el7_6.3.ppc64.rpm
libcurl-7.29.0-51.el7_6.3.ppc.rpm
libcurl-7.29.0-51.el7_6.3.ppc64.rpm
libcurl-devel-7.29.0-51.el7_6.3.ppc.rpm
libcurl-devel-7.29.0-51.el7_6.3.ppc64.rpm
ppc64le:
curl-7.29.0-51.el7_6.3.ppc64le.rpm
curl-debuginfo-7.29.0-51.el7_6.3.ppc64le.rpm
libcurl-7.29.0-51.el7_6.3.ppc64le.rpm
libcurl-devel-7.29.0-51.el7_6.3.ppc64le.rpm
s390x:
curl-7.29.0-51.el7_6.3.s390x.rpm
curl-debuginfo-7.29.0-51.el7_6.3.s390.rpm
curl-debuginfo-7.29.0-51.el7_6.3.s390x.rpm
libcurl-7.29.0-51.el7_6.3.s390.rpm
libcurl-7.29.0-51.el7_6.3.s390x.rpm
libcurl-devel-7.29.0-51.el7_6.3.s390.rpm
libcurl-devel-7.29.0-51.el7_6.3.s390x.rpm
x86_64:
curl-7.29.0-51.el7_6.3.x86_64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-7.29.0-51.el7_6.3.i686.rpm
libcurl-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-devel-7.29.0-51.el7_6.3.i686.rpm
libcurl-devel-7.29.0-51.el7_6.3.x86_64.rpm
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):
Source:
curl-7.29.0-51.el7_6.3.src.rpm
aarch64:
curl-7.29.0-51.el7_6.3.aarch64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.aarch64.rpm
libcurl-7.29.0-51.el7_6.3.aarch64.rpm
libcurl-devel-7.29.0-51.el7_6.3.aarch64.rpm
ppc64le:
curl-7.29.0-51.el7_6.3.ppc64le.rpm
curl-debuginfo-7.29.0-51.el7_6.3.ppc64le.rpm
libcurl-7.29.0-51.el7_6.3.ppc64le.rpm
libcurl-devel-7.29.0-51.el7_6.3.ppc64le.rpm
s390x:
curl-7.29.0-51.el7_6.3.s390x.rpm
curl-debuginfo-7.29.0-51.el7_6.3.s390.rpm
curl-debuginfo-7.29.0-51.el7_6.3.s390x.rpm
libcurl-7.29.0-51.el7_6.3.s390.rpm
libcurl-7.29.0-51.el7_6.3.s390x.rpm
libcurl-devel-7.29.0-51.el7_6.3.s390.rpm
libcurl-devel-7.29.0-51.el7_6.3.s390x.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
curl-7.29.0-51.el7_6.3.src.rpm
x86_64:
curl-7.29.0-51.el7_6.3.x86_64.rpm
curl-debuginfo-7.29.0-51.el7_6.3.i686.rpm
curl-debuginfo-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-7.29.0-51.el7_6.3.i686.rpm
libcurl-7.29.0-51.el7_6.3.x86_64.rpm
libcurl-devel-7.29.0-51.el7_6.3.i686.rpm
libcurl-devel-7.29.0-51.el7_6.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-14618
https://access.redhat.com/security/updates/classification/#low
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXT8OSdzjgjWX9erEAQgkpw/9H1BB0gT4Hr2JCJQqmWyEwqKcGJbvn6Kk
KXSTXDzMthovBInO4kEjcnKyxZHNrvtQ+HoDr0e2SZNTEPehh35w7tJtiwzfYzc2
wk4K7cZiaRbYzCAnkH5SanFVPIJ7PbIgZZ7eoOtSHojvrysUvqFyXY04rIzw0CIS
MMFyg2Z5RCknnXDLtGHyRRcv6Ltxmp9uoQFW+IA5Zpn/Ppq8zFmuOTLjPe762Loc
4FzYIImeJ8F/CByxg9sKnyoWxgBiA3F9GYxXjur1S3NnmWwqIoeybuyVLr05FiIO
AfQ4lStJtiJZFWjgVVjJYeM9PS7Xc+q7A0prAxKQwXXedHAqA3uAUemwlGvNhqZg
WsTJ0EZDqYi0qU00L2sc4AW65FwDko0TV3Vyzd4kmmtOa3e8F19F119CQwtwodiA
lNX+V4JFoTo3+kMSO51TWK9Mu2bldEVKcLqqjohv83TQcAeFPPVcRePuv/O6FSdo
RUxhxpsf53r0welpd1mPvwvIEz/7m8m5OAmNiRziXm1s/2vhXzUjfbyEeOq0dmOY
dc7mHZ5snB3/QtmzWf/90DMe/wpI8IIU0u+9aP6oOTS0f3Blcvm1Z85mOrCQirEA
PTW4SMfBwQ0DUrt3zBaHiegThJMv2f2ivMnNGJW+P0rW24JRp0hMjbw1e1sFLptu
Xwo4DZx4tiI=
=2qw9
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXT/W52aOgq3Tt24GAQhAxBAA1oCJe/SCVXva4/3W9aD8J/k/YafO3p29
nRbbriuMZFWIFRVB6OBQbuJUXl+I1B8cJeDATwc94TWHP82q6fbISZny6JOuyxby
FiRorp8TkbOmq/ieWCOZotzAMo7DYmrQTOD3T6BOnIO1P9HvHKEI6wLXDVoJVV0Y
VgcC3nXbdMqPL43l/DUwym+5vEQzWtLIna3Ee3ddppUO95jShG+B+fc9S8jaEeLQ
iKlS2UhshA3Y046iI1LVBnMW/zQJSc4r2e2uTqgGvCcDbuxPOyqWe/7KhVmPYBiX
6y5q9RfZBAcmTTSY4EoQ0sjzftt1bIlrNM2vB/Kd44hJYoxwC3aLfLJHxikYrfaq
xAqovaoS27N2CVFX8tvH5L+GaF0MYCsuKUIT5DxzfRJrwdgvupYkchAYaLgH+Z24
KyHQlQlqFGPFOio+LsdyGELnezqkkBmrWcV0JuXuXHyTUUxQ8xrzlxGEeVP2nqJb
Etj1D/xntmGWlSXEv9JsM9ok3AlbdW9l4v4zE1PbMOuXBhsAI5uJqNyhXKI/mtsj
ZqpjuE9ENde70DuPhQQKvQQXeW0aZaiXuwbqlsiCbvWkMESKomH/d0d1Zma/TY5Q
m3iet14J3Y/iUyoQKSPRhp6JVaKYvhnIgY+02FxfgGY4NdJLISZixkTZwJjS5ja1
a6X2qebtpCo=
=ofl5
-----END PGP SIGNATURE-----