curl (7.58.0-2ubuntu3.24) bionic-security; urgency=medium

  * SECURITY UPDATE: TELNET option IAC injection
    - debian/patches/CVE-2023-27533.patch: only accept option arguments in
      ascii in lib/telnet.c.
    - CVE-2023-27533
  * SECURITY UPDATE: SFTP path ~ resolving discrepancy
    - debian/patches/CVE-2023-27534-pre1.patch: do not add '/' if homedir
      ends with one in lib/curl_path.c.
    - debian/patches/CVE-2023-27534.patch: properly handle tilde character
      in lib/curl_path.c.
    - CVE-2023-27534
  * SECURITY UPDATE: FTP too eager connection reuse
    - debian/patches/CVE-2023-27535.patch: add more conditions for
      connection reuse in lib/ftp.c, lib/ftp.h, lib/url.c, lib/urldata.h.
    - CVE-2023-27535
  * SECURITY UPDATE: GSS delegation too eager connection re-use
    - debian/patches/CVE-2023-27536.patch: only reuse connections with same
      GSS delegation in lib/url.c, lib/urldata.h.
    - CVE-2023-27536
  * SECURITY UPDATE: SSH connection too eager reuse still
    - debian/patches/CVE-2023-27538.patch: fix the SSH connection reuse
      check in lib/url.c.
    - CVE-2023-27538

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 15 Mar 2023 08:58:03 -0400

curl (7.58.0-2ubuntu3.23) bionic-security; urgency=medium

  * SECURITY UPDATE: HTTP multi-header compression denial of service
    - debian/patches/CVE-2023-23916.patch: do not reset stage counter for
      each header in lib/content_encoding.c, lib/urldata.h,
      tests/data/Makefile.inc, tests/data/test418.
    - CVE-2023-23916

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 15 Feb 2023 08:34:26 -0500

curl (7.58.0-2ubuntu3.22) bionic-security; urgency=medium

  * SECURITY UPDATE: HTTP Proxy deny use-after-free
    - debian/patches/CVE-2022-43552.patch: do not free the protocol struct
      in *_done() in lib/smb.c, lib/telnet.c.
    - CVE-2022-43552

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 04 Jan 2023 12:08:06 -0500

curl (7.58.0-2ubuntu3.21) bionic-security; urgency=medium

  * SECURITY UPDATE: POST following PUT confusion
    - debian/patches/CVE-2022-32221.patch: when POST is set, reset the
      'upload' field in lib/setopt.c.
    - CVE-2022-32221

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 18 Oct 2022 12:45:13 -0400

curl (7.58.0-2ubuntu3.20) bionic-security; urgency=medium

  * SECURITY UPDATE: when curl sends back cookies with control bytes a
    HTTP(S) server may return a 400 response
    - debian/patches/CVE-2022-35252.patch: adds invalid_octets function
      to lib/cookie.c to reject cookies with control bytes
    - CVE-2022-35252

 -- Mark Esler <mark.esler@canonical.com>  Wed, 31 Aug 2022 14:18:59 -0500

curl (7.58.0-2ubuntu3.19) bionic-security; urgency=medium

  * SECURITY UPDATE: HTTP compression denial of service
    - debian/patches/CVE-2022-32206.patch: return error on too many
      compression steps in lib/content_encoding.c.
    - CVE-2022-32206
  * SECURITY UPDATE: FTP-KRB bad msg verification
    - debian/patches/CVE-2022-32208.patch: return error properly
      on decode errors in lib/krb5.c.
    - CVE-2022-32208

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Wed, 22 Jun 2022 13:00:50 -0300

curl (7.58.0-2ubuntu3.18) bionic-security; urgency=medium

  * SECURITY UPDATE: CERTINFO never-ending busy-loop
    - debian/patches/CVE-2022-27781.patch: return error if seemingly stuck
      in a cert loop in lib/vtls/nss.c.
    - CVE-2022-27781
  * SECURITY UPDATE: TLS and SSH connection too eager reuse
    - debian/patches/CVE-2022-27782.patch: check more TLS details for
      connection reuse in lib/setopt.c, lib/url.c, lib/urldata.h,
      lib/vtls/gtls.c, lib/vtls/openssl.c, lib/vtls/nss.c, lib/vtls/vtls.c.
    - CVE-2022-27782

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 09 May 2022 14:12:53 -0400

curl (7.58.0-2ubuntu3.17) bionic-security; urgency=medium

  * SECURITY UPDATE: OAUTH2 bypass
    - debian/patches/CVE-2022-22576.patch: check sasl additional
      parameters for conn resuse in lib/strcase.c, lib/strcase.h,
      lib/url.c, lib/urldata.h, lib/vtls/vtls.c.
    - CVE-2022-22576
  * SECURITY UPDATE: Credential leak on redirect
    - debian/patches/CVE-2022-27774-1.patch: store conn_remote_port
      in the info struct to make it available after the connection ended
      in lib/connect.c, lib/urldata.h.
    - debian/patches/CVE-2022-27774-2.patch: redirects to other protocols
      or ports clear auth in lib/transfer.c.
    - debian/patches/CVE-2022-27774-3*.patch: adds tests to verify
      these fix in tests/data/Makefile.inc, tests/data/test973,
      tests/data/test974, tests/data/test975, tests/data/test976.
    - CVE-2022-27774
  * SECURITY UPDATE: Bad local IPV6 connection reuse
    - debian/patches/CVE-2022-27775.patch: include the zone id in the
      'bundle' haskey in lib/conncache.c.
    - CVE-2022-27775
  * SECURITY UPDATE: Auth/cookie leak on redirect
    - debian/patches/CVE-2022-27776.patch: avoid auth/cookie on redirects
      same host diff port in lib/http.c, lib/urldata.h.
    - CVE-2022-27776

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 25 Apr 2022 14:19:19 -0300

curl (7.58.0-2ubuntu3.16) bionic-security; urgency=medium

  * SECURITY REGRESSION: regression in smtp starttls (LP: #1944120)
    - debian/patches/CVE-2021-22947.patch: fix bad patch backport.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 20 Sep 2021 08:02:14 -0400

curl (7.58.0-2ubuntu3.15) bionic-security; urgency=medium

  * SECURITY UPDATE: Protocol downgrade required TLS bypassed
    - debian/patches/CVE-2021-22946-pre1.patch: separate FTPS from FTP over
      HTTPS proxy in lib/ftp.c, lib/urldata.h.
    - debian/patches/CVE-2021-22946.patch: do not ignore --ssl-reqd in
      lib/ftp.c, lib/imap.c, lib/pop3.c, tests/data/Makefile.inc,
      tests/data/test984, tests/data/test985, tests/data/test986.
    - CVE-2021-22946
  * SECURITY UPDATE: STARTTLS protocol injection via MITM
    - debian/patches/CVE-2021-22947.patch: reject STARTTLS server response
      pipelining in lib/ftp.c, lib/imap.c, lib/pop3.c, lib/smtp.c,
      tests/data/Makefile.inc, tests/data/test980, tests/data/test981,
      tests/data/test982, tests/data/test983.
    - CVE-2021-22947

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 10 Sep 2021 10:29:24 -0400

# For older changelog entries, run 'apt-get changelog libcurl4'
