Release date:
2026-09-20 10:33:58 UTC
Description:
* SECURITY UPDATE: public key pinning bypassed when no server certificate
- debian/patches/CVE-2026-80230.patch: in lib/vtls/openssl.c, treat
a missing server certificate as acceptable only when no pinned
public key is configured, so pinning is still enforced with peer
and host verification disabled.
- CVE-2026-80230
* SECURITY UPDATE: cookie for an exact PSL domain kept wildcard scope
- debian/patches/CVE-2026-82209.patch: in lib/cookie.c, clear the
tailmatch flag when a cookie's Domain attribute is itself a public
suffix, so it becomes host-only instead of being sent to sibling
subdomains.
- CVE-2026-82209
Updated packages:
-
curl_7.47.0-1ubuntu2.23+tuxcare.els18_amd64.deb
sha:0b16b5da20631e8e76a94bfe634ab05c32dda305
-
libcurl3_7.47.0-1ubuntu2.23+tuxcare.els18_amd64.deb
sha:e030d7309d5234a9d6962a96f8583092761d2760
-
libcurl3-gnutls_7.47.0-1ubuntu2.23+tuxcare.els18_amd64.deb
sha:e5e807343eabbaec75275fcd3d3e87c04f91472b
-
libcurl3-nss_7.47.0-1ubuntu2.23+tuxcare.els18_amd64.deb
sha:98a640a9af1ee6afeed342229f3dfdd194f8ed00
-
libcurl4-doc_7.47.0-1ubuntu2.23+tuxcare.els18_all.deb
sha:bdfbdc8bdd0232192956f927a1ee06a0b00d6aa3
-
libcurl4-gnutls-dev_7.47.0-1ubuntu2.23+tuxcare.els18_amd64.deb
sha:f7a54d54f36d1552767057eedc782686c38070af
-
libcurl4-nss-dev_7.47.0-1ubuntu2.23+tuxcare.els18_amd64.deb
sha:60f960e3975654117b27c3eb4de82a3684b01ccd
-
libcurl4-openssl-dev_7.47.0-1ubuntu2.23+tuxcare.els18_amd64.deb
sha:3ecd89e7e82f52df8e71ab256e064d0d6404f27c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
