Debian Security Advisory

DSA-4881-1 curl -- security update

Date Reported:
30 Mar 2021
Affected Packages:
Security database references:
In the Debian bugtracking system: Bug 965280, Bug 965281, Bug 968831, Bug 977161, Bug 977162, Bug 977163.
In Mitre's CVE dictionary: CVE-2020-8169, CVE-2020-8177, CVE-2020-8231, CVE-2020-8284, CVE-2020-8285, CVE-2020-8286, CVE-2021-22876, CVE-2021-22890.
More information:

Multiple vulnerabilities were discovered in cURL, an URL transfer library:

  • CVE-2020-8169

    Marek Szlagor reported that libcurl could be tricked into prepending a part of the password to the host name before it resolves it, potentially leaking the partial password over the network and to the DNS server(s).

  • CVE-2020-8177

    sn reported that curl could be tricked by a malicious server into overwriting a local file when using the -J (--remote-header-name) and -i (--include) options in the same command line.

  • CVE-2020-8231

    Marc Aldorasi reported that libcurl might use the wrong connection when an application using libcurl's multi API sets the option CURLOPT_CONNECT_ONLY, which could lead to information leaks.

  • CVE-2020-8284

    Varnavas Papaioannou reported that a malicious server could use the PASV response to trick curl into connecting back to an arbitrary IP address and port, potentially making curl extract information about services that are otherwise private and not disclosed.

  • CVE-2020-8285

    xnynx reported that libcurl could run out of stack space when using the FTP wildcard matching functionality (CURLOPT_CHUNK_BGN_FUNCTION).

  • CVE-2020-8286

    It was reported that libcurl didn't verify that an OCSP response actually matches the certificate it is intended to.

  • CVE-2021-22876

    Viktor Szakats reported that libcurl does not strip off user credentials from the URL when automatically populating the Referer HTTP request header field in outgoing HTTP requests.

  • CVE-2021-22890

    Mingtao Yang reported that, when using an HTTPS proxy and TLS 1.3, libcurl could confuse session tickets arriving from the HTTPS proxy as if they arrived from the remote server instead. This could allow an HTTPS proxy to trick libcurl into using the wrong session ticket for the host and thereby circumvent the server TLS certificate check.

For the stable distribution (buster), these problems have been fixed in version 7.64.0-4+deb10u2.

We recommend that you upgrade your curl packages.

For the detailed security status of curl please refer to its security tracker page at: