USN-6718-2: curl vulnerability
27 March 2024
curl could be made to denial of service.
Releases
Packages
- curl - HTTP, HTTPS, and FTP client and client libraries
Details
USN-6718-1 fixed a vulnerability in curl. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that curl incorrectly handled memory when limiting the
amount of headers when HTTP/2 server push is allowed. A remote attacker
could possibly use this issue to cause curl to consume resources, leading
to a denial of service. (CVE-2024-2398)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04
-
curl
-
7.58.0-2ubuntu3.24+esm4
Available with Ubuntu Pro
-
libcurl3-gnutls
-
7.58.0-2ubuntu3.24+esm4
Available with Ubuntu Pro
-
libcurl3-nss
-
7.58.0-2ubuntu3.24+esm4
Available with Ubuntu Pro
-
libcurl4
-
7.58.0-2ubuntu3.24+esm4
Available with Ubuntu Pro
Ubuntu 16.04
-
curl
-
7.47.0-1ubuntu2.19+esm12
Available with Ubuntu Pro
-
libcurl3
-
7.47.0-1ubuntu2.19+esm12
Available with Ubuntu Pro
-
libcurl3-gnutls
-
7.47.0-1ubuntu2.19+esm12
Available with Ubuntu Pro
-
libcurl3-nss
-
7.47.0-1ubuntu2.19+esm12
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-6718-1: libcurl4, libcurl4-doc, libcurl4-nss-dev, curl, libcurl4-openssl-dev, libcurl3-gnutls, libcurl4-gnutls-dev, libcurl3-nss
- USN-6718-3: libcurl4-doc, curl, libcurl3t64-gnutls, libcurl4-openssl-dev, libcurl4t64, libcurl4-gnutls-dev