Re: lftp is affected by curl CVE-2014-0139

"Alexander V. Lukyanov" <[email protected]> Tue, 10 Feb 2015 15:25:03 +0300

Newsgroups	gmane.network.lftp.user
Message-ID	<[email protected]>

On Tue, Dec 09, 2014 at 06:46:32PM +0100, Vitezslav Cizek wrote:
> Hi,
> I've noticed lftp is using code borrowed from curl.
> That makes lftp affected by CVE-2014-0139:
> http://curl.haxx.se/docs/adv_20140326B.html
> 
> It's not the most critical vulnerability, but anyway,
> I'll suggest to update to code from latest curl for the next release.

Thanks for report!

I've included hostmatch function from the latest curl. The fixed
version is in github now and a snapshot is here:
	http://lftp.yar.ru/ftp/devel/lftp-4.6.1.20150210.tar.gz

-- 
   Alexander.
_______________________________________________
lftp mailing list
[email protected]
http://univ.uniyar.ac.ru/mailman/listinfo/lftp