Advisories ยป MGASA-2024-0360

Updated curl packages fix security vulnerability

Publication date: 12 Nov 2024
Modification date: 11 Nov 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-9681

Description

When curl is asked to use HSTS, the expiry time for a subdomain might
overwrite a parent domain's cache entry, making it end sooner or later
than otherwise intended. This affects curl using applications that
enable HSTS and use URLs with the insecure HTTP:// scheme and perform
transfers with hosts like x.example.com as well as example.com where the
first host is a subdomain of the second host. This flaw also affects the
curl command line tool.
When triggered, this is a potential minor DoS security problem when
trying to use HTTPS when that no longer works or a cleartext
transmission of data that was otherwise intended to possibly be
protected.
This update fixes the issue so subdomains cannot affect the HSTS cache
of a parent domain.

References

SRPMS

9/core