-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2015:021 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : curl Date : January 12, 2015 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated curl packages fix security vulnerability: When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL (CVE-2014-8150). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8150 http://advisories.mageia.org/MGASA-2015-0020.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: cbf237775c5e1ca9bb4682d51bd28556 mbs1/x86_64/curl-7.24.0-3.8.mbs1.x86_64.rpm 45f01de00df39d1b46f9e35172c38dbb mbs1/x86_64/curl-examples-7.24.0-3.8.mbs1.x86_64.rpm 574c629f73b354a3be90064f312b6c84 mbs1/x86_64/lib64curl4-7.24.0-3.8.mbs1.x86_64.rpm 46c44721804a2f0b9fa3734656505bc0 mbs1/x86_64/lib64curl-devel-7.24.0-3.8.mbs1.x86_64.rpm b54588388c5e4a620672c871489e620a mbs1/SRPMS/curl-7.24.0-3.8.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFUs7CzmqjQ0CJFipgRAtoPAJ0dGoTpMEEe8qVIF6NHXa5zzmj4GQCgxxqM IStoYE0u+k6e8Wj/8q4lxo0= =bhc7 -----END PGP SIGNATURE-----
