USN-5079-4
curl regression
USN-5079-2 fixed vulnerabilities in curl. One of the fixes introduced a regression. This update fixes the problem.
Original advisory details:
Patrick Monnerat discovered that curl incorrectly handled upgrades to TLS. When receiving certain responses from servers, curl would continue without TLS even when the option to require a successful upgrade to TLS was specified. (CVE-2021-22946)
Patrick Monnerat discovered that curl incorrectly handled responses received before STARTTLS. A remote attacker could possibly use this issue to inject responses and intercept communications. (CVE-2021-22947)
What each source reports
OSVNo score
curl regression
USN-5079-2 fixed vulnerabilities in curl. One of the fixes introduced a regression. This update fixes the problem.
Original advisory details:
Patrick Monnerat discovered that curl incorrectly handled upgrades to TLS. When receiving certain responses from servers, curl would continue without TLS even when the option to require a successful upgrade to TLS was specified. (CVE-2021-22946)
Patrick Monnerat discovered that curl incorrectly handled responses received before STARTTLS. A remote attacker could possibly use this issue to inject responses and intercept communications. (CVE-2021-22947)
- Record
USN-5079-4- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlUbuntu:Pro:14.04:LTS | before 7.35.0-1ubuntu2.20+esm9, plus listed versions 7.32.0-1ubuntu17.33.0-1ubuntu17.34.0-1ubuntu17.35.0-1ubuntu17.35.0-1ubuntu2 Show 25 moreShow less7.35.0-1ubuntu2.17.35.0-1ubuntu2.27.35.0-1ubuntu2.37.35.0-1ubuntu2.57.35.0-1ubuntu2.67.35.0-1ubuntu2.77.35.0-1ubuntu2.87.35.0-1ubuntu2.97.35.0-1ubuntu2.107.35.0-1ubuntu2.117.35.0-1ubuntu2.127.35.0-1ubuntu2.137.35.0-1ubuntu2.147.35.0-1ubuntu2.157.35.0-1ubuntu2.167.35.0-1ubuntu2.177.35.0-1ubuntu2.197.35.0-1ubuntu2.207.35.0-1ubuntu2.20+esm27.35.0-1ubuntu2.20+esm37.35.0-1ubuntu2.20+esm47.35.0-1ubuntu2.20+esm57.35.0-1ubuntu2.20+esm67.35.0-1ubuntu2.20+esm77.35.0-1ubuntu2.20+esm8 | 7.35.0-1ubuntu2.20+esm9 |
curlUbuntu:Pro:16.04:LTS | before 7.47.0-1ubuntu2.19+esm2, plus listed versions 7.43.0-1ubuntu27.45.0-1ubuntu17.46.0-1ubuntu17.47.0-1ubuntu17.47.0-1ubuntu2 Show 18 moreShow less7.47.0-1ubuntu2.17.47.0-1ubuntu2.27.47.0-1ubuntu2.37.47.0-1ubuntu2.47.47.0-1ubuntu2.57.47.0-1ubuntu2.67.47.0-1ubuntu2.77.47.0-1ubuntu2.87.47.0-1ubuntu2.97.47.0-1ubuntu2.117.47.0-1ubuntu2.127.47.0-1ubuntu2.137.47.0-1ubuntu2.147.47.0-1ubuntu2.157.47.0-1ubuntu2.167.47.0-1ubuntu2.187.47.0-1ubuntu2.197.47.0-1ubuntu2.19+esm1 | 7.47.0-1ubuntu2.19+esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-5079-4 is a vulnerability with no CVSS score yet in curl, published September 21, 2021. No source lists public exploit code. Fixed in curl 7.35.0-1ubuntu2.20+esm9.