Accepted curl 7.52.1-5+deb9u16 (source amd64 all) into oldoldstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 29 Sep 2021 21:03:02 +0200
Source: curl
Binary: curl libcurl3 libcurl3-gnutls libcurl3-nss libcurl4-openssl-dev libcurl4-gnutls-dev libcurl4-nss-dev libcurl3-dbg libcurl4-doc
Architecture: source amd64 all
Version: 7.52.1-5+deb9u16
Distribution: stretch-security
Urgency: medium
Maintainer: Alessandro Ghedini <ghedo@debian.org>
Changed-By: Thorsten Alteholz <debian@alteholz.de>
Description:
curl - command line tool for transferring data with URL syntax
libcurl3 - easy-to-use client-side URL transfer library (OpenSSL flavour)
libcurl3-dbg - debugging symbols for libcurl (OpenSSL, GnuTLS and NSS flavours)
libcurl3-gnutls - easy-to-use client-side URL transfer library (GnuTLS flavour)
libcurl3-nss - easy-to-use client-side URL transfer library (NSS flavour)
libcurl4-doc - documentation for libcurl
libcurl4-gnutls-dev - development files and documentation for libcurl (GnuTLS flavour)
libcurl4-nss-dev - development files and documentation for libcurl (NSS flavour)
libcurl4-openssl-dev - development files and documentation for libcurl (OpenSSL flavour)
Changes:
curl (7.52.1-5+deb9u16) stretch-security; urgency=medium
.
* Non-maintainer upload by the LTS Team.
* CVE-2021-22946
Crafted answers from a server might force clients to not use TLS on
connections though TLS was required and expected.
* CVE-2021-22947
When using STARTTLS to initiate a TLS connection, the server might
send multiple answers before the TLS upgrade and such the client
would handle them as being trusted. This could be used by a
MITM-attacker to inject fake response data.
Checksums-Sha1:
9e88eb32e6cac05f34eddff0702b0c621cfea6b5 2956 curl_7.52.1-5+deb9u16.dsc
73097952ada80fbaff924c706ba57d1f77c38d00 3504621 curl_7.52.1.orig.tar.gz
77d28c01ea763739d0c7ea66b6247f7b2e2f3284 68076 curl_7.52.1-5+deb9u16.debian.tar.xz
c1b27a9b130d91cead960e4d2fcdf7aa27b5645e 131908 curl-dbgsym_7.52.1-5+deb9u16_amd64.deb
fda8633025131a03e9bd33e3425cb3c021bfcaba 11425 curl_7.52.1-5+deb9u16_amd64.buildinfo
6beafd8e0bdf4bb1c4005134c7a2ab40d8b585d6 228768 curl_7.52.1-5+deb9u16_amd64.deb
5178246d84cdb0215cc592a481942492e8f1cc47 5096978 libcurl3-dbg_7.52.1-5+deb9u16_amd64.deb
87c3fbe5c2f74eee354e732be9e391fa11119af9 296148 libcurl3-gnutls_7.52.1-5+deb9u16_amd64.deb
b67051a53fa23173948ae76e9e394a5572046b8c 301912 libcurl3-nss_7.52.1-5+deb9u16_amd64.deb
76388abfc679a3f66c8cad18c2f88949d45610e8 298370 libcurl3_7.52.1-5+deb9u16_amd64.deb
6d2d2e57450ef505fc66c1791dca1369c83abee7 829464 libcurl4-doc_7.52.1-5+deb9u16_all.deb
6f4b18ae98fdd4be90ec4a7056e6185f862fee01 380648 libcurl4-gnutls-dev_7.52.1-5+deb9u16_amd64.deb
2975d94de9ddf283fe935cac9b01cea9789e9416 386434 libcurl4-nss-dev_7.52.1-5+deb9u16_amd64.deb
b8a94227c125292e0cc137140df2ba81532ba590 382650 libcurl4-openssl-dev_7.52.1-5+deb9u16_amd64.deb
Checksums-Sha256:
983ffa16e37e057f0c15a3bfbc23598e2b8b436e61c4c2bc12efa71a9bdf31f8 2956 curl_7.52.1-5+deb9u16.dsc
a8984e8b20880b621f61a62d95ff3c0763a3152093a9f9ce4287cfd614add6ae 3504621 curl_7.52.1.orig.tar.gz
3b5a01e9b08e5e845a368c6f4c82cdd221a029afe264b5954aa646c8c30b6373 68076 curl_7.52.1-5+deb9u16.debian.tar.xz
7363b655b3ecc3c36baae9903c76736dd1bb0c1db171520acf3efb4ef0a4f905 131908 curl-dbgsym_7.52.1-5+deb9u16_amd64.deb
be975a05ee8cd1b04c2b1e3ef09fc60431396760e76b883cf4b3eb30b88b5fef 11425 curl_7.52.1-5+deb9u16_amd64.buildinfo
4bf6b575bc3fcc861838d8383b478d42a55fbf0d717f0c44cfc23d2d1978195b 228768 curl_7.52.1-5+deb9u16_amd64.deb
ee755c2d35c124935ccb74c50ad2b058c0b2f0e20a37699ab1aaf6c9f80d11b1 5096978 libcurl3-dbg_7.52.1-5+deb9u16_amd64.deb
5b8abe4c17939ba9f8fd37376aca6404cea57dd5c9f2caa0ad9cb269559827a7 296148 libcurl3-gnutls_7.52.1-5+deb9u16_amd64.deb
a19ce3bfc28851c8a8eed721ac1b6b6a00e59ab8699800d62e808c6436f22282 301912 libcurl3-nss_7.52.1-5+deb9u16_amd64.deb
bbdb3d7be2577c07593b1035cd70a1d288ec7632db3e17304cef27529065ad66 298370 libcurl3_7.52.1-5+deb9u16_amd64.deb
f2dc1ba27e835703787bed67bfed130d83ad4a431f7493dc2d63830dc9402b63 829464 libcurl4-doc_7.52.1-5+deb9u16_all.deb
7e2aaa2273315b279452db23c6f60e327bc27739e5d0bfa029dd61ca6e3490d8 380648 libcurl4-gnutls-dev_7.52.1-5+deb9u16_amd64.deb
227a75cb307c866818f5a7956a94cd7757dd90d9bae27e2da99acea366529bb8 386434 libcurl4-nss-dev_7.52.1-5+deb9u16_amd64.deb
a5aca5b152787efe86b6a7b3072e8019ba0c570c80b3ddc616d6caf83f92a373 382650 libcurl4-openssl-dev_7.52.1-5+deb9u16_amd64.deb
Files:
64ada4e514b7beecff33315b82df2974 2956 web optional curl_7.52.1-5+deb9u16.dsc
4e1ef056e117b4d25f4ec42ac609c0d4 3504621 web optional curl_7.52.1.orig.tar.gz
743bda40fabac3ecc269657cb751bc3d 68076 web optional curl_7.52.1-5+deb9u16.debian.tar.xz
a3a8d4649a6bb17309b8a0f3305ad209 131908 debug extra curl-dbgsym_7.52.1-5+deb9u16_amd64.deb
737dd590a5c18ebe81c73ac8965ffd6d 11425 web optional curl_7.52.1-5+deb9u16_amd64.buildinfo
7143af8b7dc93f7e2953a1cd8ef70861 228768 web optional curl_7.52.1-5+deb9u16_amd64.deb
229b3bbafafe6bfce741a6ef962a7049 5096978 debug extra libcurl3-dbg_7.52.1-5+deb9u16_amd64.deb
ebdba94763f118ff129ce71a98473cf8 296148 libs optional libcurl3-gnutls_7.52.1-5+deb9u16_amd64.deb
f0ff50ba57bd619eec3568604925f86b 301912 libs optional libcurl3-nss_7.52.1-5+deb9u16_amd64.deb
21583b193675351cef461918710ae0b1 298370 libs optional libcurl3_7.52.1-5+deb9u16_amd64.deb
d2b9e5769b610a35423a5e3df2fd9437 829464 doc optional libcurl4-doc_7.52.1-5+deb9u16_all.deb
7833baa569d299ac4ef27e5732bc6250 380648 libdevel optional libcurl4-gnutls-dev_7.52.1-5+deb9u16_amd64.deb
503cf93299455d3f13d65a311eea9887 386434 libdevel optional libcurl4-nss-dev_7.52.1-5+deb9u16_amd64.deb
71b7b3271f22eaf9e1d3cfc68ce956e8 382650 libdevel optional libcurl4-openssl-dev_7.52.1-5+deb9u16_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQKnBAEBCgCRFiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmFVv3NfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcTHGRlYmlhbkBh
bHRlaG9sei5kZQAKCRCW/KwNOHtYR0DnD/45iHZTeiAacNtMjCQiook7li/C2cDy
YV8uB9Jw4ua7DmYROHTAgJ7RBJ6aCfOm2XCl/pFyDm4e7Ce/BO1SK1TyeqPy5/4k
bags7Hjk7mDcDlJ5ZsA2PXyWBNXYp1iIqtChi9cY/xbGNC6ShkWl6tGqfEfHyc8j
/lVBqXpN61qETpUv4xTXKVtWNPrwx2uscrWiXvkENnAcJq+ci1MVXnbIl+Nxbwx0
CdKxCO6SA383aSax83I21MzShLJSWuBroOcdr/bB0fJFnfLr2CyG8xS4zYL29Glf
XCSdqrK+QMnCdqIwan2q5UtNJgrdwoAXUuU2qDNJZEp6XjgscLDQtp626ZiTKN2g
gJj5U9cFQ5k0V5zAE3uRetDF1mJz3MLylbe8D/0bZpsWvFc0KqunD4vMzDlpDJQ0
ERQAw1lCBuvVpOz70cFkai2QXGtPqjpo5jCPZUhverNzPgrF92OE1eIfFu9Gj7qf
uscZaJFlwEFFsvgTd+VMHcOg2eMG5Ig7FMxn4YAYVjdx0rlUEBDfUhTu96PZhlTB
24de/VJAIZaKvhzMaYfpTDLWjSl4hw6jzNhgW6lD5zEsf5Q5LVO7FDJ/RGIdvN74
W/pSbl61fJehEniW3YrEo23MBYdINVOhHTBm/nEJxT7bIa+4tBETgs7e1VTyxJXQ
ZmISC9w2fLVTwg==
=/RHT
-----END PGP SIGNATURE-----
Reply to: