Ubuntu alert USN-8670-2 (curl)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8670-2] curl vulnerability
Date:
             
 
Tue, 25 Aug 2026 23:46:47 +0000
Message-ID:
             
 
<E1wz0qt-0002Uo-Di@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8670-2
August 25, 2026

curl vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

curl could be made to expose sensitive information.

Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

USN-8670-1 fixed a vulnerability in curl. This update provides the
corresponding update for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
22.04 LTS.

Original advisory details:

 Joshua Rogers discovered that curl incorrectly handled reusing
 connections when client certificate settings changed. This could result
 in the wrong client certificates being used, contrary to expectations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  curl                            7.81.0-1ubuntu1.27
  libcurl3-gnutls                 7.81.0-1ubuntu1.27
  libcurl3-nss                    7.81.0-1ubuntu1.27
  libcurl4                        7.81.0-1ubuntu1.27
  libcurl4-gnutls-dev             7.81.0-1ubuntu1.27
  libcurl4-nss-dev                7.81.0-1ubuntu1.27
  libcurl4-openssl-dev            7.81.0-1ubuntu1.27

Ubuntu 20.04 LTS
  curl                            7.68.0-1ubuntu2.25+esm7
                                  Available with Ubuntu Pro
  libcurl3-gnutls                 7.68.0-1ubuntu2.25+esm7
                                  Available with Ubuntu Pro
  libcurl3-nss                    7.68.0-1ubuntu2.25+esm7
                                  Available with Ubuntu Pro
  libcurl4                        7.68.0-1ubuntu2.25+esm7
                                  Available with Ubuntu Pro
  libcurl4-gnutls-dev             7.68.0-1ubuntu2.25+esm7
                                  Available with Ubuntu Pro
  libcurl4-nss-dev                7.68.0-1ubuntu2.25+esm7
                                  Available with Ubuntu Pro
  libcurl4-openssl-dev            7.68.0-1ubuntu2.25+esm7
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  curl                            7.58.0-2ubuntu3.24+esm12
                                  Available with Ubuntu Pro
  libcurl3-gnutls                 7.58.0-2ubuntu3.24+esm12
                                  Available with Ubuntu Pro
  libcurl3-nss                    7.58.0-2ubuntu3.24+esm12
                                  Available with Ubuntu Pro
  libcurl4                        7.58.0-2ubuntu3.24+esm12
                                  Available with Ubuntu Pro
  libcurl4-gnutls-dev             7.58.0-2ubuntu3.24+esm12
                                  Available with Ubuntu Pro
  libcurl4-nss-dev                7.58.0-2ubuntu3.24+esm12
                                  Available with Ubuntu Pro
  libcurl4-openssl-dev            7.58.0-2ubuntu3.24+esm12
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8670-2
  https://ubuntu.com/security/notices/USN-8670-1
  CVE-2026-8932

Package Information:
  https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.27


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqN5McACgkQcpJm3tlz
hgEAlA/9GAPvbbZEoNzgepKZjev8w5ARIWlGNdi/HYkRIqxaGSlpqQq1v45qBu3N
F4JUg5G9otbtI3f5igey2Q6pxYtI3QGosvqYf8kV+Dp3XdXzQqaKczxJelgE3iBS
PS9ZmcNFtf5ii9Igd1RoZ8n1ZJEQwVuAAh6A731/A9KqnjZomQOIR4ac+zLQ6gHZ
/cbhlT4Vl4ZORuM8plUP1wupEFl9v4U0DGuwcA3FSr2busb8h7nsiXG0qT3nWy+S
5kTH+OiY1hKrnp7hna8CEI0pgdsihkJGmmGeSPvfKcV0Led2E2FChhjAdVgtHyN3
HztGXklNWZj4QBSGPLgXmb3Mldgy45wh07OAVfbYdEFypJr3ZyDRh8bCQe2W3tvP
/YPgL2uWadZtmfpRsXZVYRJhK8VFEIzJwja9ZOHQjC1Ywq5eC+MpqNiolyX1EKL8
YhhOnBraPNFTemAbgaf/54j2drsoKi99bCXZgc2oiWtRy161KkRJgu/M43mjgFeW
2H6yjSrfmoQ19dT3q86rQV6BRyq99bWZyPK79aKlwDBz53BalmpfkhEM6DyBMggs
cv71nW97WUVEF6qTZN8g8jT3CteJezu/e4dSW38BdRehSIMy2iSCYOt6cWSptRcq
IFg28AdoqOwvbilYqi+n+M7w2kt/9+tjrF3yZSh8A9wb2AiWWuE=
=+DOn
-----END PGP SIGNATURE-----