Issued:
2012-02-20
Updated:
2012-02-20

RHBA-2012:0241 - curl bug fix and enhancement update

Synopsis

curl bug fix and enhancement update

Type/Severity

Bug Fix Advisory (none)

Topic

An updated curl package that fixes multiple bugs and adds two enhancements is now available for Red Hat Enterprise Linux 5.

Description

The curl package provides the libcurl library and the cURL command line tool for transferring data using various protocols, including FTP, HTTP, Gopher, Telnet, and DICT. Both, libcurl and cURL, support many useful capabilities, such as user authentication, proxy support, FTP uploading, HTTP POST and PUT methods, SSL certificates, and file transfer resume.

This update fixes the following bugs:

  • In the FTP implementation, libcurl incorrectly called the accept() function from a system library, which caused a stack overflow under certain circumstances. This update applies a backported upstream patch that corrects this bug, and the stack overflow no longer occurs. (BZ#652557)

  • Previously, an attempt to send an LDAP request through an HTTP proxy tunnel ended up with cURL trying to connect to the LDAP server directly using a wrong port number. With this update, the underlying source code has been modified to fix this problem, and cURL now works as expected. (BZ#655073)

  • Previously, the "multi" interface of libcurl was broken, which caused the "git push" command to work incorrectly over the Web Distributed Authoring and Versioning (WebDAV) protocol. This update applies an upstream patch, which corrects counting of active connections in the "multi" interface. The "git push" command now works as expected over WebDAV. (BZ#688871)

  • As a solution to a security issue, GSSAPI credential delegation was disabled, which broke the functionality of the applications that were relying on delegation, which was incorrectly enabled by libcurl. To fix this problem, the CURLOPT_GSSAPI_DELEGATION libcurl option has been introduced in order to enable delegation explicitly when applications need it. All applications using GSSAPI credential delegation can now use this new libcurl option to be able to run properly. (BZ#723643)

In addition, this update adds the following enhancements:

  • Previously, curl did not support proxy authentication using Kerberos. With this update, underlying code has been modified and curl now allows Kerberos proxy authentication by using the "--proxy-negotiate" option. (BZ#657396)

  • The cURL utility did not allow Kerberos credential delegation although the libcurl library provided appropriate support for this functionality. This update introduces a new option, "--delegation", which enables Kerberos credential delegation in cURL. (BZ#746849)

All users of curl are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements. All running applications that use libcurl have to be restarted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.https://access.redhat.com/kb/docs/DOC-11259

Affected Products

ProductVersionArch
Red Hat Enterprise Linux for Power, big endian5ppc
Red Hat Enterprise Linux for IBM z Systems5s390x
Red Hat Enterprise Linux Workstation5x86_64
Red Hat Enterprise Linux Workstation5i386
Red Hat Enterprise Linux Server5x86_64
Red Hat Enterprise Linux Server5ia64
Red Hat Enterprise Linux Server5i386
Red Hat Enterprise Linux Server from RHUI5x86_64
Red Hat Enterprise Linux Server from RHUI5i386
Red Hat Enterprise Linux Desktop5x86_64
Red Hat Enterprise Linux Desktop5i386

Updated Packages

  • curl-devel-7.15.5-15.el5.ppc.rpm
  • curl-devel-7.15.5-15.el5.x86_64.rpm
  • curl-devel-7.15.5-15.el5.ppc64.rpm
  • curl-7.15.5-15.el5.s390x.rpm
  • curl-7.15.5-15.el5.ppc.rpm
  • curl-7.15.5-15.el5.s390.rpm
  • curl-devel-7.15.5-15.el5.i386.rpm
  • curl-devel-7.15.5-15.el5.ia64.rpm
  • curl-7.15.5-15.el5.i386.rpm
  • curl-7.15.5-15.el5.ia64.rpm
  • curl-7.15.5-15.el5.x86_64.rpm
  • curl-7.15.5-15.el5.ppc64.rpm
  • curl-devel-7.15.5-15.el5.s390x.rpm
  • curl-devel-7.15.5-15.el5.s390.rpm
  • curl-7.15.5-15.el5.src.rpm

Fixes

CVEs

(none)

References

(none)

Additional information