USN-8670-1

Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client certificates being used, contrary to expectations.

References

Affected packages

Ubuntu:24.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.5.0-2ubuntu10.13

Affected versions

8.*

8.2.1-1ubuntu3

8.2.1-1ubuntu3.1

8.4.0-2ubuntu1

8.5.0-2ubuntu1

8.5.0-2ubuntu2

8.5.0-2ubuntu8

8.5.0-2ubuntu9

8.5.0-2ubuntu10

8.5.0-2ubuntu10.1

8.5.0-2ubuntu10.2

8.5.0-2ubuntu10.3

8.5.0-2ubuntu10.4

8.5.0-2ubuntu10.5

8.5.0-2ubuntu10.6

8.5.0-2ubuntu10.7

8.5.0-2ubuntu10.8

8.5.0-2ubuntu10.9

8.5.0-2ubuntu10.10

8.5.0-2ubuntu10.11

8.5.0-2ubuntu10.12

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "8.5.0-2ubuntu10.13",
            "binary_name": "curl"
        },
        {
            "binary_version": "8.5.0-2ubuntu10.13",
            "binary_name": "libcurl3t64-gnutls"
        },
        {
            "binary_version": "8.5.0-2ubuntu10.13",
            "binary_name": "libcurl4t64"
        }
    ]
}

Database specific

cves_map

{
    "ecosystem": "Ubuntu:24.04:LTS",
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-8932"
        }
    ]
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8670-1.json"