==========================================================================
Ubuntu Security Notice USN-7104-1
November 18, 2024
curl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Summary:
curl could be made to expose sensitive information over the network.
Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries
Details:
It was discovered that curl could overwrite the HSTS expiry of the parent
domain with the subdomain's HSTS entry. This could lead to curl switching
back to insecure HTTP earlier than otherwise intended, resulting in
information exposure.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
  curl                            8.9.1-2ubuntu2.1
  libcurl3t64-gnutls              8.9.1-2ubuntu2.1
  libcurl4t64                     8.9.1-2ubuntu2.1
Ubuntu 24.04 LTS
  curl                            8.5.0-2ubuntu10.5
  libcurl3t64-gnutls              8.5.0-2ubuntu10.5
  libcurl4t64                     8.5.0-2ubuntu10.5
Ubuntu 22.04 LTS
  curl                            7.81.0-1ubuntu1.19
  libcurl3-gnutls                 7.81.0-1ubuntu1.19
  libcurl3-nss                    7.81.0-1ubuntu1.19
  libcurl4                        7.81.0-1ubuntu1.19
In general, a standard system update will make all the necessary changes.
References:
  https://ubuntu.com/security/notices/USN-7104-1
  CVE-2024-9681
Package Information:
  https://launchpad.net/ubuntu/+source/curl/8.9.1-2ubuntu2.1
  https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.5
  https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.19