Red Hat ENTERPRISE 5.4 RELEASE NOTES, Руководство пользователя

Страница: 54 / 466

Chapter 1. Package Updates
36
1.30. curl
1.30.1. RHSA-2009:1209: Moderate security update
Important
This update has already been released (prior to the GA of this release) as the security
errata
RHSA-2009:1209
219
Updated curl packages that fix security issues are now available for Red Hat Enterprise Linux 3, 4,
and 5.
This update has been rated as having moderate security impact by the Red Hat Security Response
Team.
cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the
supported protocols. cURL is designed to work without user interaction or any kind of interactivity.
Scott Cantor reported that cURL is affected by the previously published "null prefix attack", caused
by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-
crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate
during a man-in-the-middle attack and potentially confuse cURL into accepting it by mistake.
(
CVE-2009-2417
220
)
cURL users should upgrade to these updated packages, which contain a backported patch to correct
these issues. All running applications using libcurl must be restarted for the update to take effect.
1.30.2. RHSA-2009:0341: Moderate security update
Important
This update has already been released (prior to the GA of this release) as the security
errata
RHSA-2009:0341
221
Updated curl packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3,
4, and 5.
This update has been rated as having moderate security impact by the Red Hat Security Response
Team.
cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the
supported protocols. cURL is designed to work without user interaction or any kind of interactivity.
David Kierznowski discovered a flaw in libcurl where it would not differentiate between different
target URLs when handling automatic redirects. This caused libcurl to follow any new URL that it
understood, including the "file://" URL type. This could allow a remote server to force a local libcurl-
using application to read a local file instead of the remote one, possibly exposing local files that were
not meant to be exposed. (
CVE-2009-0037
222
)
220
https://www.redhat.com/security/data/cve/CVE-2009-2417.html
222
https://www.redhat.com/security/data/cve/CVE-2009-0037.html