Package "libcurl4-gnutls-dev"
| Name: |
libcurl4-gnutls-dev
|
Description: |
development files and documentation for libcurl (GnuTLS flavour)
|
| Latest version: |
7.81.0-1ubuntu1.30 |
| Release: |
jammy (22.04) |
| Level: |
updates |
| Repository: |
main |
| Head package: |
curl |
| Homepage: |
https://curl.haxx.se |
Links
Download "libcurl4-gnutls-dev"
Other versions of "libcurl4-gnutls-dev" in Jammy
Changelog
|
curl (7.81.0-1ubuntu1.30) jammy-security; urgency=medium
* SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.
- debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when
CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c.
- CVE-2026-86409
* SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.
- debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a
CONNECT request in lib/http_proxy.c.
- CVE-2026-86414
* SECURITY UPDATE: Improper handling of HSTS entries on load.
- debian/patches/CVE-2026-87862.patch: match only the exact host, not
parent domains, when removing duplicates while loading an HSTS file in
lib/hsts.c.
- CVE-2026-87862
* SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.
- debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion
is enabled, as it makes the upload size unknown in lib/imap.c.
- CVE-2026-87864
* SECURITY UPDATE: Use after free in FTP wildcard matching.
- debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func
and set.out in lib/sendf.c, lib/ftp.h, lib/ftp.c, lib/ftplistparser.c,
lib/ftplistparser.h.
- debian/patches/CVE-2026-92388-2.patch: only use the list parser in the
CURLWC_MATCHING state in lib/ftplistparser.c.
- CVE-2026-92388
* SECURITY UPDATE: Information exposure from TFTP transfer direction
confusion.
- debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a
server response does not match the transfer direction in lib/tftp.c.
- CVE-2026-92389
* SECURITY UPDATE: Stack overflow from deeply nested MIME structures.
- debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in
curl_mime_free in lib/mime.c.
- CVE-2026-92391
* SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.
- debian/patches/CVE-2026-94266.patch: return a copy of the URL without
credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,
lib/url.c, lib/urldata.h.
- CVE-2026-94266
-- Charles Cochran Mon, 12 Oct 2026 18:12:33 -0400
|
| Source diff to previous version |
| CVE-2026-86409 |
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on t |
| CVE-2026-86414 |
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answer |
| CVE-2026-87862 |
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, |
| CVE-2026-87864 |
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded da |
| CVE-2026-92388 |
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the |
| CVE-2026-92389 |
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for bot |
| CVE-2026-92391 |
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An exces |
| CVE-2026-94266 |
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the U |
|
|
curl (7.81.0-1ubuntu1.29) jammy-security; urgency=medium
[ Charles Cocharn ]
* SECURITY UPDATE: Use after free in HTTP/2 server push.
- debian/patches/CVE-2026-18924.patch: make server push transfers
inherit share from parent in lib/http2.c.
- CVE-2026-18924
* SECURITY UPDATE: Public key pinning bypass.
- debian/patches/CVE-2026-80230.patch: require server cert if public
key pinned in lib/vtls/openssl.c.
- CVE-2026-80230
* SECURITY UPDATE: Cookie injection for public suffix domains.
- debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact
PSL domain are host-only in lib/cookie.c, tests/data/Makefile.inc,
tests/data/test1136, tests/data/test2318.
- CVE-2026-82209
[ Kyle Kernick ]
* SECURITY REGRESSION: checksrc errors and failing test case for
CVE-2026-8927 (LP #2167779)
- debian/patches/CVE-2026-6429.patch: Fix indentation to fix
autopkgtests in lib/transfer.c.
- debian/patches/CVE-2026-8458.patch: Wrap long lines and fix
indentation to fix autopkgtests in lib/curl_sasl.c.
- debian/patches/CVE-2026-8932.patch: Wrap long lines to fix
autopkgtests in lib/url.c, lib/vtls/nss.c, and lib/vtls/openssl.c.
- debian/patches/CVE-2026-8927.patch: Fix failing test
-- Charles Cochran Fri, 18 Sep 2026 11:47:53 -0400
|
| Source diff to previous version |
| 2167779 |
Reverted security upload 8.20.0-2ubuntu4, broken checksrc and CVE-2026-8927 backport |
| CVE-2026-18924 |
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-af |
| CVE-2026-80230 |
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL |
| CVE-2026-82209 |
When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domai |
| CVE-2026-8927 |
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentic |
| CVE-2026-6429 |
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the f |
| CVE-2026-8458 |
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different |
| CVE-2026-8932 |
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. li |
|
|
curl (7.81.0-1ubuntu1.25) jammy-security; urgency=medium
* SECURITY UPDATE: Connection reuse for starttls protocols.
- debian/patches/CVE-2026-8286.patch: When a connection is tested for
reuse in a transfer that may upgrade to TLS (commonly via STARTTLS),
the SSL configuration must match the existing connection in lib/url.c
- CVE-2026-8286
* SECURITY UPDATE: Connection reuse in SASL.
- debian/patches/CVE-2026-8458.patch: Fix erroneous connection reuse in
in lib/curl_sasl.c, lib/http_negotiate.c, lib/http_ntlm.c, lib/imap.c,
lib/openldap.c, and lib/pop3.c
- CVE-2026-8458
* SECURITY UPDATE: Cookie injection in is_public_suffix.
- debian/patches/CVE-2026-8924.patch: Trim trailing dots when checking
PSL in lib/cookie.c.
- CVE-2026-8924
* SECURITY UPDATE: Double-free in gsasl.
- debian/patches/CVE-2026-8925.patch: Require libgasl 1.6.0 to handle
NULL argument in lib/vauth/gsasl.c.
- CVE-2026-8925
* SECURITY UPDATE: Information disclosure in libcurl
- debian/patches/CVE-2026-8927.patch: Detect if proxy is not the same as
previous and flush state in lib/url.c and lib/urldata.h.
- CVE-2026-8927
* SECURITY UPDATE: Man-in-the-middle in libcurl.
- debian/patches/CVE-2026-9547.patch: Reject host key mismatches in
in lib/vssh/libssh.c
- CVE-2026-9547
-- Kyle Kernick <email address hidden> Mon, 29 Jun 2026 11:21:28 -0600
|
About
-
Send Feedback to @ubuntu_updates
