Package "libcurl4-openssl-dev"
| Name: |
libcurl4-openssl-dev
|
Description: |
development files and documentation for libcurl (OpenSSL flavour)
|
| Latest version: |
7.81.0-1ubuntu1.30 |
| Release: |
jammy (22.04) |
| Level: |
security |
| Repository: |
main |
| Head package: |
curl |
| Homepage: |
https://curl.haxx.se |
Links
Download "libcurl4-openssl-dev"
Other versions of "libcurl4-openssl-dev" in Jammy
Changelog
|
curl (7.81.0-1ubuntu1.30) jammy-security; urgency=medium
* SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.
- debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when
CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c.
- CVE-2026-86409
* SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.
- debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a
CONNECT request in lib/http_proxy.c.
- CVE-2026-86414
* SECURITY UPDATE: Improper handling of HSTS entries on load.
- debian/patches/CVE-2026-87862.patch: match only the exact host, not
parent domains, when removing duplicates while loading an HSTS file in
lib/hsts.c.
- CVE-2026-87862
* SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.
- debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion
is enabled, as it makes the upload size unknown in lib/imap.c.
- CVE-2026-87864
* SECURITY UPDATE: Use after free in FTP wildcard matching.
- debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func
and set.out in lib/sendf.c, lib/ftp.h, lib/ftp.c, lib/ftplistparser.c,
lib/ftplistparser.h.
- debian/patches/CVE-2026-92388-2.patch: only use the list parser in the
CURLWC_MATCHING state in lib/ftplistparser.c.
- CVE-2026-92388
* SECURITY UPDATE: Information exposure from TFTP transfer direction
confusion.
- debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a
server response does not match the transfer direction in lib/tftp.c.
- CVE-2026-92389
* SECURITY UPDATE: Stack overflow from deeply nested MIME structures.
- debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in
curl_mime_free in lib/mime.c.
- CVE-2026-92391
* SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.
- debian/patches/CVE-2026-94266.patch: return a copy of the URL without
credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,
lib/url.c, lib/urldata.h.
- CVE-2026-94266
-- Charles Cochran Mon, 12 Oct 2026 18:12:33 -0400
|
| Source diff to previous version |
|
curl (7.81.0-1ubuntu1.29) jammy-security; urgency=medium
[ Charles Cocharn ]
* SECURITY UPDATE: Use after free in HTTP/2 server push.
- debian/patches/CVE-2026-18924.patch: make server push transfers
inherit share from parent in lib/http2.c.
- CVE-2026-18924
* SECURITY UPDATE: Public key pinning bypass.
- debian/patches/CVE-2026-80230.patch: require server cert if public
key pinned in lib/vtls/openssl.c.
- CVE-2026-80230
* SECURITY UPDATE: Cookie injection for public suffix domains.
- debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact
PSL domain are host-only in lib/cookie.c, tests/data/Makefile.inc,
tests/data/test1136, tests/data/test2318.
- CVE-2026-82209
[ Kyle Kernick ]
* SECURITY REGRESSION: checksrc errors and failing test case for
CVE-2026-8927 (LP #2167779)
- debian/patches/CVE-2026-6429.patch: Fix indentation to fix
autopkgtests in lib/transfer.c.
- debian/patches/CVE-2026-8458.patch: Wrap long lines and fix
indentation to fix autopkgtests in lib/curl_sasl.c.
- debian/patches/CVE-2026-8932.patch: Wrap long lines to fix
autopkgtests in lib/url.c, lib/vtls/nss.c, and lib/vtls/openssl.c.
- debian/patches/CVE-2026-8927.patch: Fix failing test
-- Charles Cochran Fri, 18 Sep 2026 11:47:53 -0400
|
| Source diff to previous version |
| 2167779 |
Reverted security upload 8.20.0-2ubuntu4, broken checksrc and CVE-2026-8927 backport |
| CVE-2026-18924 |
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-af |
| CVE-2026-80230 |
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL |
| CVE-2026-82209 |
When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domai |
| CVE-2026-8927 |
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentic |
| CVE-2026-6429 |
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the f |
| CVE-2026-8458 |
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different |
| CVE-2026-8932 |
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. li |
|
|
curl (7.81.0-1ubuntu1.25) jammy-security; urgency=medium
* SECURITY UPDATE: Connection reuse for starttls protocols.
- debian/patches/CVE-2026-8286.patch: When a connection is tested for
reuse in a transfer that may upgrade to TLS (commonly via STARTTLS),
the SSL configuration must match the existing connection in lib/url.c
- CVE-2026-8286
* SECURITY UPDATE: Connection reuse in SASL.
- debian/patches/CVE-2026-8458.patch: Fix erroneous connection reuse in
in lib/curl_sasl.c, lib/http_negotiate.c, lib/http_ntlm.c, lib/imap.c,
lib/openldap.c, and lib/pop3.c
- CVE-2026-8458
* SECURITY UPDATE: Cookie injection in is_public_suffix.
- debian/patches/CVE-2026-8924.patch: Trim trailing dots when checking
PSL in lib/cookie.c.
- CVE-2026-8924
* SECURITY UPDATE: Double-free in gsasl.
- debian/patches/CVE-2026-8925.patch: Require libgasl 1.6.0 to handle
NULL argument in lib/vauth/gsasl.c.
- CVE-2026-8925
* SECURITY UPDATE: Information disclosure in libcurl
- debian/patches/CVE-2026-8927.patch: Detect if proxy is not the same as
previous and flush state in lib/url.c and lib/urldata.h.
- CVE-2026-8927
* SECURITY UPDATE: Man-in-the-middle in libcurl.
- debian/patches/CVE-2026-9547.patch: Reject host key mismatches in
in lib/vssh/libssh.c
- CVE-2026-9547
-- Kyle Kernick <email address hidden> Mon, 29 Jun 2026 11:21:28 -0600
|
About
-
Send Feedback to @ubuntu_updates
