Public bug reported: A new release of curl is available for merging from Debian.
Ubuntu: 8.20.0-2ubuntu11 Debian Unstable: 8.23.0-1 ### New Debian Changes ### curl (8.23.0-1) unstable; urgency=high * New upstream version 8.23.0 -- Samuel Henrique <[email protected]> Tue, 13 Oct 2026 23:00:18 -0700 curl (8.23.0~rc3-1) unstable; urgency=medium * New upstream version 8.23.0~rc3. (Closes: #1149508) * debian/patches: rebase patches. -- Carlos Henrique Lima Melara <[email protected]> Wed, 07 Oct 2026 21:43:25 -0300 curl (8.23.0~rc2-1) unstable; urgency=medium * New upstream version 8.23.0~rc2 * d/p/sws_fix_connection...: Drop patch applied upstream * d/p/Implement-symbol-versioning-for-CURL_GNUTLS_3.patch: Refresh patch -- Samuel Henrique <[email protected]> Sat, 26 Sep 2026 11:25:38 -0700 curl (8.23.0~rc1-2) unstable; urgency=medium * d/p/sws_fix_connection-monitor...: New patch to fix test issue -- Samuel Henrique <[email protected]> Wed, 23 Sep 2026 20:42:15 -0700 curl (8.23.0~rc1-1) unstable; urgency=medium * New upstream version 8.23.0~rc1 * Refresh patches -- Samuel Henrique <[email protected]> Mon, 21 Sep 2026 18:58:38 -0700 curl (8.22.0-1) unstable; urgency=medium * New upstream version 8.22.0 * d/watch: Fix regex for release tarball * d/patches: rebase patches on 8.22.0: ZZZgnutls-build.patch needed a conflict resolution in the test Makefile.am hunks: upstream added nodist_libtests_SOURCES and nodist_tunits_SOURCES next to the LDADD lines the patch rewrites to use $(LIBCURL_FILESTUB).la. While there, drop the patch's gratuitous $(BUNDLE).c -> ${BUNDLE}.c change in tests/tunit/Makefile.am. . 8.22.0 also adds a new tests/perf/ directory whose LDADD refers to lib/libcurl.la, so extend the patch to cover it too. Without this the GnuTLS flavour fails to build the test suite with "No rule to make target '../../lib/libcurl.la', needed by 'perf'". . The other patches only needed context refreshes. -- Samuel Henrique <[email protected]> Tue, 01 Sep 2026 23:27:46 -0700 curl (8.22.0~rc3-1) unstable; urgency=medium * New upstream version 8.22.0~rc3 * d/patches: Drop patches applied upstream: - tests-fix-test2064-content-length-mismatch.patch - ws-fix-write-callback-error-handling.patch * d/patches: Refresh Implement-symbol-versioning-for-CURL_GNUTLS_3.patch -- Samuel Henrique <[email protected]> Wed, 26 Aug 2026 19:36:54 -0700 curl (8.22.0~rc2-2) unstable; urgency=medium * debian/patches: cherry-pick patches from upstream to fix regressions. - cookie-allow-loading-cookies-for-localhost.patch: cherry-pick from upstream. Thanks to Athos Coimbra Ribeiro for investigating and reporting upstream. - ws-fix-write-callback-error-handling.patch: cherry-pick from upstream. Thanks to Scott Talbert for investigating and reporting upstream. -- Carlos Henrique Lima Melara <[email protected]> Mon, 24 Aug 2026 00:10:56 -0300 curl (8.22.0~rc2-1) unstable; urgency=medium * New upstream version 8.22.0~rc2 * d/p/tests-fix-type-promotion-on-32-bit-arches.patch: Drop patch applied upstream * Refresh patches: - build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch - Implement-symbol-versioning-for-CURL_GNUTLS_3.patch - ZZZgnutls-build.patch - disable-strictmodes-in-test-sshd.patch * d/p/tests-fix-test2064-content-length-mismatch.patch: add patch. Upstream's test2064 declares Content-Length: 26 but sends a 27 byte body, which makes curl 8.22.0~rc2 fail the digest retry on the reused connection with "Invalid status line". The test passed on 8.21.0. * d/libcurl4-doc.docs: docs/INTERNALS.md is gone upstream, its content moved to docs/DEPENDENCIES.md. * d/tests/control: add openssh-client to the pytest http tests. openssh-server 1:10.4p1 no longer depends on it, so /usr/bin/scp was missing from the testbed and the six test_50_scp.py cases failed while sftp kept working. -- Samuel Henrique <[email protected]> Mon, 17 Aug 2026 20:53:25 -0700 curl (8.21.0-2) unstable; urgency=medium * d/p/tests-fix-type-promotion-on-32-bit-arches.patch: add patch. (Closes: #1140793) -- Carlos Henrique Lima Melara <[email protected]> Sun, 28 Jun 2026 17:49:59 -0300 curl (8.21.0-1) unstable; urgency=medium * New upstream version 8.21.0. * debian/copyright: update upstream copyright holders for new release. * debian/patches: rebase patches. -- Carlos Henrique Lima Melara <[email protected]> Wed, 24 Jun 2026 22:26:04 -0300 curl (8.21.0~rc3-1) unstable; urgency=medium * New upstream version 8.21.0~rc3. (Closes: #1140043) * debian/control: drop Priority field, optional is default now. * debian/patches: rebase patches. -- Carlos Henrique Lima Melara <[email protected]> Thu, 18 Jun 2026 22:38:41 -0300 curl (8.21.0~rc2-1) unstable; urgency=medium [ Samuel Henrique ] * New upstream version 8.21.0~rc2 * d/p/event-fix-wakeup-consumption.patch: Drop patch applied upstream * Refresh patches: - Implement-symbol-versioning-for-CURL_GNUTLS_3.patch - ZZZgnutls-build.patch - build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch * d/rules: strip arch triplet from compiler name in curl-config [ Guilherme Puida Moreira ] * d/p/disable-strictmodes-in-test-sshd.patch: allow sshd in autopkgtest env * d/tests: add pytest-based http tests -- Samuel Henrique <[email protected]> Sat, 13 Jun 2026 16:22:50 -0700 curl (8.20.0-5) unstable; urgency=medium * d/control: Mark libcurl3t64-gnutls as Arch: any, M-A: same. Thanks to Simon McVittie <[email protected]> (Closes: #1138629) -- Sergio Durigan Junior <[email protected]> Mon, 01 Jun 2026 15:36:45 -0400 curl (8.20.0-4) unstable; urgency=medium * d/p/Implement-symbol-versioning-for-CURL_GNUTLS_3.patch: Adjust to disable checksrc's LONGLINE check (and fix autopkgtest). -- Sergio Durigan Junior <[email protected]> Sun, 31 May 2026 22:50:30 -0400 curl (8.20.0-3) unstable; urgency=medium * d/p/ZZZgnutls-build.patch: Use same SO version for both libraries. * d/libgnutls3t64-gnutls.symbols: s/CURL_GNUTLS_3/CURL_GNUTLS_4/. * d/p/Implement-symbol-versioning-for-CURL_GNUTLS_3.patch: Implement symbol versioning for CURL_GNUTLS_3 symbols. (Closes: #1020780) * d/control: New package libcurl4-gnutls. Also turn libcurl3t64-gnutls into a transitional package that depends on libcurl4-gnutls. * d/libcurl3t64-gnutls*: Rename to d/libcurl4-gnutls*. * d/libcurl4-gnutls.symbols: Add CURL_GNUTLS_3 symbols. * d/rules: Adjust install-curl recipe to use libcurl4-gnutls. * d/libcurl4-gnutls.symbols: Fix version on all libcurl4-gnutls symbols. We have to mark all symbols as having been introduced by the latest Debian release of the package. This is necessary because we want future programs to link against this version specifically, not previous libcurl3t64-gnutls versions. * d/libcurl4-gnutls.lintian-overrides: Adjust for new package name. * d/copyright: Update file. -- Sergio Durigan Junior <[email protected]> Fri, 29 May 2026 17:19:53 -0400 ### Old Ubuntu Delta ### curl (8.20.0-2ubuntu11) stonking; urgency=medium [ Charles Cochran ] * SECURITY UPDATE: Authentication bypass in LDAP SASL negotiation. - debian/patches/CVE-2026-13608.patch: openldap: handle Curl_sasl_continue() returns better in lib/openldap.c. - CVE-2026-13608 * SECURITY UPDATE: Use after free in HTTP/2 server push. - debian/patches/CVE-2026-18924.patch: make server push transfers inherit share from parent in lib/http2.c. - CVE-2026-18924 * SECURITY UPDATE: Use after free in OpenSSL library context. - debian/patches/CVE-2026-80229.patch: avoid conn reuse if provider is used in lib/vtls/openssl.c. - CVE-2026-80229 * SECURITY UPDATE: Public key pinning bypass. - debian/patches/CVE-2026-80230.patch: require server cert if public key pinned in lib/vtls/openssl.c. - CVE-2026-80230 * SECURITY UPDATE: Cookie Secure attribute bypass in Set-Cookie. - debian/patches/CVE-2026-80255.patch: improve TAB handling in lib/cookie.c, tests/data/Makefile.am, tests/data/test2885. - CVE-2026-80255 * SECURITY UPDATE: Cookie injection for public suffix domains. - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact PSL domain are host-only in lib/cookie.c, tests/data/Makefile.am, tests/data/test1136, tests/data/test2318, tests/data/test798. - CVE-2026-82209 [ Kyle Kernick ] * SECURITY UPDATE: Use after free in curl_easy_reset. - debian/patches/CVE-2026-10536.patch: Deprecate CURLOPT_* in include/curl/curl.h, lib/http2.c, lib/setopt.c, lib/url.c, and lib/urldata.h - CVE-2026-10536 * SECURITY UPDATE: Denial of service in QUIC UDP. - debian/patches/CVE-2026-11352.patch: Count zero-length UDP packets and enforce an upper bound in lib/vquic/vquic.c - CVE-2026-11352 * SECURITY UPDATE: Improper certificate validation in native_ca_store. - debian/patches/CVE-2026-11564.patch: Add bit native_ca_store_opt to keep the setting of CURLOPT_(PROXY_)SSL_OPTIONS and use that to calculate every easy transfer if a native CA store shall be used or not in lib/doh.c, lib/setopt.c, and lib/vtls/vtls.c - CVE-2026-11564 * SECURITY UPDATE: Memory exhaustion in ws.c - debian/patches/CVE-2026-11586.patch: Do not send PONG frames unless there is sufficient space left in the websocket send buffer in lib/ws.c. - CVE-2026-11586 * SECURITY UPDATE: Authentication Bypass by Capture-replay - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and lib/vauth/digest_sspi.c. - CVE-2026-11856 * SECURITY UPDATE: Improper validation in config2setopts. - debian/patches/CVE-2026-12064.patch: Use default protocol properly in src/config2setopts.c. - CVE-2026-12064 * SECURITY UPDATE: Connection reuse for starttls protocols. - debian/patches/CVE-2026-8286.patch: When a connection is tested for reuse in a transfer that may upgrade to TLS (commonly via STARTTLS), the SSL configuration must match the existing connection in lib/url.c - CVE-2026-8286 * SECURITY UPDATE: Connection reuse in SASL. - debian/patches/CVE-2026-8458.patch: Fix erroneous connection reuse in lib/curl_sasl.c, lib/http_negotiate.c, and lib/http_ntlm.c. - CVE-2026-8458 * SECURITY UPDATE: Cookie injection in is_public_suffix. - debian/patches/CVE-2026-8924.patch: Trim trailing dots when checking PSL in lib/cookie.c. - CVE-2026-8924 * SECURITY UPDATE: Double-free in gsasl. - debian/patches/CVE-2026-8925.patch: Require libgsasl 1.6.0 to handle NULL argument in lib/vauth/gsasl.c. - CVE-2026-8925 * SECURITY UPDATE: Information disclosure in netrc. - debian/patches/CVE-2026-8926.patch: Do not return a password from parsenetrc() when the requested login did not match the credentials found for the matched machine in lib/netrc.c. - CVE-2026-8926 * SECURITY UPDATE: Information disclosure in libcurl - debian/patches/CVE-2026-8927.patch: Detect if proxy is not the same as previous and flush state in lib/url.c and lib/urldata.h. - debian/patches/CVE-2026-9079.patch: Verify NULLed proxy credentials in lib/setopt.c. - debian/patches/CVE-2026-9545.patch: Hard fail when certificate verification fails in lib/vquic/curl_ngtcp2.c. - CVE-2026-8927 - CVE-2026-9079 - CVE-2026-9545 * SECURITY UPDATE: Use-after-free in curl_easy_pause - debian/patches/CVE-2026-9080.patch: Introduce magic struct field to assert against NULL pointers in lib/multi_ev.c - debian/patches/CVE-2026-9080-post1.patch: Refresh sock entry after remove callback in lib/multi_ev.c - CVE-2026-9080 * SECURITY UPDATE: Information disclosure in libcurl - debian/patches/CVE-2026-9546.patch: clear referer in lib/transfer.c - CVE-2026-9546 * SECURITY UPDATE: Man-in-the-middle in libcurl. - debian/patches/CVE-2026-9547.patch: Reject host key mismatches in lib/vssh/libssh.c. - CVE-2026-9547 -- Kyle Kernick <[email protected]> Wed, 23 Sep 2026 15:00:22 -0600 curl (8.20.0-2ubuntu10) stonking; urgency=medium * Fix typo that inadvertently enabled upki -dev dependency on i386 -- Julian Andres Klode <[email protected]> Tue, 22 Sep 2026 11:20:58 +0200 curl (8.20.0-2ubuntu9) stonking; urgency=medium * REVERT broken 8.20.0-2ubuntu4 SECURITY upload - `checksrc` fixes in 8.20.0-2ubuntu7 were ok - but CVE 2026-8927 was incorrectly backported and the tests failed - see LP #2167779 for more details * upki fixes: - libcurl4-openssl-dev: depend on libupki-openssl-dev - fix #if defined() to ifdef - fix old style c issue in autopkgtest checksrc -- Julian Andres Klode <[email protected]> Sun, 20 Sep 2026 00:08:57 +0200 curl (8.20.0-2ubuntu7) stonking; urgency=medium * Include upki integration for OpenSSL build (LP: #2167691), excluding s390x (big endian) and i386 (no upki) * fix checksrc-warning from cve fix -- Julian Andres Klode <[email protected]> Fri, 18 Sep 2026 17:50:35 +0200 curl (8.20.0-2ubuntu3) stonking; urgency=medium * SECURITY UPDATE: Authentication Bypass in connection reuse. - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in lib/ldap.c, lib/urldata.h, lib/vssh/libssh.c, lib/vssh/libssh2.c, lib/vtls/gtls.c, lib/vtls/mbedtls.c, lib/vtls/openssl.c, lib/vtls/rustls.c, lib/vtls/schannel.c, lib/vtls/vtls.c, lib/vtls/vtls_scache.c, and lib/vtls/wolfssl.c. - CVE-2026-8932 -- Kyle Kernick <[email protected]> Tue, 08 Sep 2026 12:31:08 -0600 curl (8.20.0-2ubuntu2) stonking; urgency=medium * No-change rebuild against libssl4 -- Ravi Kant Sharma <[email protected]> Fri, 24 Jul 2026 07:56:19 +0000 curl (8.20.0-2ubuntu1) stonking; urgency=medium * Merge with Debian unstable (LP: #2153275). Remaining changes: - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe - d/control: don't build-depend on python3-impacket and stunnel on i386 * Dropped delta removed earlier: - d/control: do not use gnutls for the curl binary [Dropped in 8.13.0-2] -- Ural Tunaboyu <[email protected]> Fri, 29 May 2026 09:10:13 -0700 ** Affects: curl (Ubuntu) Importance: Wishlist Status: New ** Tags: dcr-merge ** Changed in: curl (Ubuntu) Importance: Undecided => Wishlist ** Changed in: curl (Ubuntu) Milestone: None => ubuntu-26.11 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171202 Title: Merge curl 8.23.0-1 from Debian for tenacious cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/curl/+bug/2171202/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
