MGASA-2024-0360 - Updated curl packages fix security vulnerability

Publication date: 12 Nov 2024
URL: https://advisories.mageia.org/MGASA-2024-0360.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2024-9681

When curl is asked to use HSTS, the expiry time for a subdomain might
overwrite a parent domain's cache entry, making it end sooner or later
than otherwise intended. This affects curl using applications that
enable HSTS and use URLs with the insecure HTTP:// scheme and perform
transfers with hosts like x.example.com as well as example.com where the
first host is a subdomain of the second host. This flaw also affects the
curl command line tool.
When triggered, this is a potential minor DoS security problem when
trying to use HTTPS when that no longer works or a cleartext
transmission of data that was otherwise intended to possibly be
protected.
This update fixes the issue so subdomains cannot affect the HSTS cache
of a parent domain.

References:
- https://bugs.mageia.org/show_bug.cgi?id=33730
- https://curl.se/docs/CVE-2024-9681.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9681

SRPMS:
- 9/core/curl-7.88.1-4.4.mga9