USN-6944-1: curl vulnerability

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• curl - HTTP, HTTPS, and FTP client and client libraries

Details

Dov Murik discovered that curl incorrectly handled parsing ASN.1
Generalized Time fields. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly obtain
sensitive memory contents.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• curl - 8.5.0-2ubuntu10.2
• libcurl3t64-gnutls - 8.5.0-2ubuntu10.2
• libcurl4t64 - 8.5.0-2ubuntu10.2

Ubuntu 22.04

• curl - 7.81.0-1ubuntu1.17
• libcurl3-gnutls - 7.81.0-1ubuntu1.17
• libcurl3-nss - 7.81.0-1ubuntu1.17
• libcurl4 - 7.81.0-1ubuntu1.17

Ubuntu 20.04

• curl - 7.68.0-1ubuntu2.23
• libcurl3-gnutls - 7.68.0-1ubuntu2.23
• libcurl3-nss - 7.68.0-1ubuntu2.23
• libcurl4 - 7.68.0-1ubuntu2.23

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-7264

Related notices

• USN-6944-2: libcurl4-openssl-dev, curl, libcurl3, libcurl4-nss-dev, libcurl4-doc, libcurl3-nss, libcurl3-gnutls, libcurl4, libcurl4-gnutls-dev