- CVE-2023-28322: more POST-after-PUT confusion (https://curl.se/docs/CVE-2023-28322.html) - CVE-2023-28321: IDN wildcard match (https://curl.se/docs/CVE-2023-28321.html) - CVE-2023-28320: siglongjmp race condition (https://curl.se/docs/CVE-2023-28320.html) - CVE-2023-28319: UAF in SSH sha256 fingerprint check (https://curl.se/docs/CVE-2023-28319.html) All fixed in just-released 8.1.0.
> - CVE-2023-28320: siglongjmp race condition > (https://curl.se/docs/CVE-2023-28320.html) Fascinatingly, this one is the thing we struggled with for years. See bug 699632 and e.g. https://stackoverflow.com/questions/9191668/error-longjmp-causes-uninitialized-stack-frame.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=31dc8554f228c128a5b81dbe05395057b029f4da commit 31dc8554f228c128a5b81dbe05395057b029f4da Author: Matt Jolly <Matt.Jolly@footclan.ninja> AuthorDate: 2023-05-17 07:10:58 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2023-05-17 07:58:06 +0000 net-misc/curl: add 8.1.0 Bug: https://bugs.gentoo.org/906590 Signed-off-by: Matt Jolly <Matt.Jolly@footclan.ninja> Signed-off-by: Sam James <sam@gentoo.org> net-misc/curl/Manifest | 2 + net-misc/curl/curl-8.1.0.ebuild | 316 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 318 insertions(+)