Re: [BLFS Trac] #23491: curl-8.21.0

#23491: curl-8.21.0
-----------------------------+------------------------
 Reporter:  Douglas R. Reno  |       Owner:  blfs-book
     Type:  enhancement      |      Status:  new
 Priority:  elevated         |   Milestone:  13.1
Component:  BOOK             |     Version:  git
 Severity:  normal           |  Resolution:
 Keywords:                   |
-----------------------------+------------------------
Changes (by Douglas R. Reno):

 * priority:  normal => elevated

Comment:

 {{{
 Hello friends,

 In association with the curl release 8.21.0 that we announced just minutes
 ago, we
 publish no less than eighteen new curl vulnerabilities.

 Because of the large amount of issues, sending individual emails for each
 one would be a
 bit much so instead I list them all below and I link to each issue's
 individual
 explainer page.

 CVE, title and severity. Listed here in numerical order. The order in
 which they were
 reported to us.

 CVE-2026-8286: wrong STARTTLS connection reuse (LOW)
   https://curl.se/docs/CVE-2026-8286.html

 CVE-2026-8458: wrong reuse for different services (LOW)
   https://curl.se/docs/CVE-2026-8458.html

 CVE-2026-8924: traling dot domain super cookie (LOW)
   https://curl.se/docs/CVE-2026-8924.html

 CVE-2026-8925: SASL double-free (MEDIUM)
   https://curl.se/docs/CVE-2026-8925.html

 CVE-2026-8926: password leak with netrc and user in URL (LOW)
   https://curl.se/docs/CVE-2026-8926.html

 CVE-2026-8927: env-set cross-proxy Digest auth state leak (MEDIUM)
   https://curl.se/docs/CVE-2026-8927.html

 CVE-2026-8932: incomplete mTLS config matching in conn reuse (LOW)
   https://curl.se/docs/CVE-2026-8932.html

 CVE-2026-9079: stale proxy password leak (MEDIUM)
   https://curl.se/docs/CVE-2026-9079.html

 CVE-2026-9080: UAF after pause in socket callback (LOW)
   https://curl.se/docs/CVE-2026-9080.html

 CVE-2026-9545: exposing HTTP/3 early data (LOW)
   https://curl.se/docs/CVE-2026-9545.html

 CVE-2026-9546: sending old referer (LOW)
   https://curl.se/docs/CVE-2026-9546.html

 CVE-2026-9547: SSH improper host validation (LOW)
   https://curl.se/docs/CVE-2026-9547.html

 CVE-2026-10536: HTTP/2 stream-dependency tree UAF (LOW)
   https://curl.se/docs/CVE-2026-10536.html

 CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (LOW)
   https://curl.se/docs/CVE-2026-11352.html

 CVE-2026-11564: Native CA trust persist (LOW)
   https://curl.se/docs/CVE-2026-11564.html

 CVE-2026-11586: WS Auto-PONG memory exhaustion (LOW)
   https://curl.se/docs/CVE-2026-11586.html

 CVE-2026-11856: cross-origin Digest auth state leak (MEDIUM)
   https://curl.se/docs/CVE-2026-11856.html

 CVE-2026-12064: proto-default skips SSH verification (LOW)
   https://curl.se/docs/CVE-2026-12064.html
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23491#comment:1>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page