Ubuntu alert USN-5495-2 (curl)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-5495-2] curl regression
Date:
             
 
Mon, 29 Sep 2025 14:54:55 +0000
Message-ID:
             
 
<E1v3FHD-0006hl-Hy@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-5495-2
September 29, 2025

curl regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS

Summary:

USN-5495-1 introduced a regression in curl

Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

USN-5495-1 fixed vulnerabilities in curl. The fix for CVE-2022-32205
miscalculated the maximum cookie size, causing a regression. This update
fixes the problem.

Original advisory details:

 Harry Sintonen discovered that curl incorrectly handled certain cookies.
 An attacker could possibly use this issue to cause a denial of service.
 This issue only affected Ubuntu 21.10, and Ubuntu 22.04 LTS. (CVE-2022-32205)

 Harry Sintonen discovered that curl incorrectly handled certain HTTP compressions.
 An attacker could possibly use this issue to cause a denial of service.
 (CVE-2022-32206)

 Harry Sintonen incorrectly handled certain file permissions.
 An attacker could possibly use this issue to expose sensitive information.
 This issue only affected Ubuntu 21.10, and Ubuntu 22.04 LTS. (CVE-2022-32207)

 Harry Sintonen discovered that curl incorrectly handled certain FTP-KRB messages.
 An attacker could possibly use this to perform a machine-in-the-middle attack.
 (CVE-2022-32208)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  curl                            7.81.0-1ubuntu1.21
  libcurl3-gnutls                 7.81.0-1ubuntu1.21
  libcurl3-nss                    7.81.0-1ubuntu1.21
  libcurl4                        7.81.0-1ubuntu1.21

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5495-2
  https://ubuntu.com/security/notices/USN-5495-1
  https://launchpad.net/bugs/2118865

Package Information:
  https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.21


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmjanZ0ACgkQcpJm3tlz
hgHIkg/+MgjgA8j/Ha8qx6j4q2bv04FRUazYX+N7Xpp+lS/mniDmQpcl/uVh24Id
rIEpQ8Q7rbVdESB24ytWkjODmiSvMbxMQtpzR4eUXTlB8kThIuZC7eICx0qxzsJq
0dXrN7DOUgmiSjcaOlreWaGd0fJa+7Klh+N5F7ZJZH4C3hSzy4c55GLN7zHnrwfn
qMYIo6FHpqF2OcSgcuqIldcubP2CrJD5uXed5usZyiO7+JUNVVBtOVxQR9D346K9
BlkcaUQwRPALcBa3VSeca+yFpW/VOf7tL5j6ScLSCqYQj08PnhoETCmHKf3+c3OU
CGuK6rdxj9SZatGryG6BLu82Rpvhvbgg1Qx/4RKXd+i6viZh3rhkM464nqpu5gBi
tYCymk0PGvlJPGphYeG6GYvhUj4V1YjzvZus3KxSUG5t9fgg+ZHCMly1a3dHZfqt
piJzL0UrbvgFzn02BVdWk2Pt9KDzLo4JOz5tymP3wbo5BJPzgft+4SAkzMjUQWWu
ePle1KYOkTGrPZQU6Qnl7rDSjRRrq8v44d9Z18bb6QlirPiTicKfmng+bMNGqSuJ
TbXT4mrgMOc0DAaFarwum47QTnQINh6FXyxSvuYlrQPCts+LRWPZBb0QquggSRbN
9vXJI7Bk2px9JS7MVRof9Hd8ZTv63nTDNIz4q2NY35aCE1+Jxhw=
=Ujnf
-----END PGP SIGNATURE-----