FEDORA-2016-24316f1f56 — security update for curl

stable

curl-7.47.1-6.fc24

FEDORA-2016-24316f1f56 created by kdudka 6 years ago for Fedora 24

fix re-using connections with wrong client cert (CVE-2016-5420)
fix TLS session resumption client cert bypass (CVE-2016-5419)
fix use of connection struct after free (CVE-2016-5421)

How to install

sudo dnf upgrade --refresh --advisory=FEDORA-2016-24316f1f56

This update has been submitted for testing by kdudka.

6 years ago

This update has been pushed to testing.

6 years ago

bojan commented & provided feedback 6 years ago

karma

Services depending on libcurl appear to start normally.

yuwata commented & provided feedback 6 years ago

karma

works for me

This update has been submitted for stable by bodhi.

6 years ago

cserpentis commented & provided feedback 6 years ago

karma

works for me

kdudka commented & provided feedback 6 years ago

Thanks for feedback!

This update has been pushed to stable.

6 years ago

skamath commented & provided feedback 6 years ago

karma

Works for me.

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

None

Builds

curl-7.47.1-6.fc24

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

6 years ago

in testing

6 years ago

in stable

6 years ago

BZ#1362183 CVE-2016-5419 curl: TLS session resumption client cert bypass

BZ#1362190 CVE-2016-5420 curl: Re-using connection with wrong client cert

BZ#1362199 CVE-2016-5421 curl: Use of connection struct after free

BZ#1363642 CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 curl: various flaws [fedora-all]

curl-7.47.1-6.fc24

Automated Test Results

None