curl (7.81.0-1ubuntu1.25) jammy-security; urgency=medium

  * SECURITY UPDATE: Connection reuse for starttls protocols.
    - debian/patches/CVE-2026-8286.patch: When a connection is tested for
      reuse in a transfer that may upgrade to TLS (commonly via STARTTLS),
      the SSL configuration must match the existing connection in lib/url.c
    - CVE-2026-8286
  * SECURITY UPDATE: Connection reuse in SASL.
    - debian/patches/CVE-2026-8458.patch: Fix erroneous connection reuse in
      in lib/curl_sasl.c, lib/http_negotiate.c, lib/http_ntlm.c, lib/imap.c,
      lib/openldap.c, and lib/pop3.c
    - CVE-2026-8458
  * SECURITY UPDATE: Cookie injection in is_public_suffix.
    - debian/patches/CVE-2026-8924.patch: Trim trailing dots when checking
      PSL in lib/cookie.c.
    - CVE-2026-8924
  * SECURITY UPDATE: Double-free in gsasl.
    - debian/patches/CVE-2026-8925.patch: Require libgasl 1.6.0 to handle
      NULL argument in lib/vauth/gsasl.c.
    - CVE-2026-8925
  * SECURITY UPDATE: Information disclosure in libcurl
    - debian/patches/CVE-2026-8927.patch: Detect if proxy is not the same as
      previous and flush state in lib/url.c and lib/urldata.h.
    - CVE-2026-8927
  * SECURITY UPDATE: Man-in-the-middle in libcurl.
    - debian/patches/CVE-2026-9547.patch: Reject host key mismatches in
      in lib/vssh/libssh.c
    - CVE-2026-9547

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 29 Jun 2026 11:21:28 -0600

curl (7.81.0-1ubuntu1.24) jammy-security; urgency=medium

  * SECURITY UPDATE: connection reuse ignores TLS requirement
    - debian/patches/CVE-2026-4873.patch: do not reuse a non-tls starttls
      connection if new requires TLS in lib/url.c.
    - CVE-2026-4873
  * SECURITY UPDATE: wrong reuse of HTTP Negotiate connection
    - debian/patches/CVE-2026-5545.patch: improve connection reuse on
      negotiate in lib/url.c.
    - CVE-2026-5545
  * SECURITY UPDATE: wrong reuse of SMB connection
    - debian/patches/CVE-2026-5773.patch: disable connection reuse for
      SMB(S) in lib/smb.c.
    - CVE-2026-5773
  * SECURITY UPDATE: proxy credentials leak over redirect-to proxy
    - debian/patches/CVE-2026-6253.patch: clear the proxy credentials as
      well on port or scheme change in lib/transfer.*, tests/*.
    - CVE-2026-6253
  * SECURITY UPDATE: stale custom cookie host causes cookie leak
    - debian/patches/CVE-2026-6276.patch: move cookiehost to struct
      SingleRequest in lib/http.c, lib/url.c, lib/urldata.h, tests/*.
    - CVE-2026-6276
  * SECURITY UPDATE: netrc credential leak with reused proxy connection
    - debian/patches/CVE-2026-6429-pre1.patch: prevent secure schemes
      pushed over insecure connections in lib/http2.c.
    - debian/patches/CVE-2026-6429-pre2.patch: same origin tests in
      lib/http2.c, lib/urlapi-int.h, lib/urlapi.c.
    - debian/patches/CVE-2026-6429.patch: clear credentials better on
      redirect in lib/transfer.c, tests/*.
    - CVE-2026-6429
  * SECURITY UPDATE: cross-proxy Digest auth state leak
    - debian/patches/CVE-2026-7168.patch: clear proxy auth properties when
      switching in lib/setopt.c, lib/vauth/vauth.h, tests/*.
    - CVE-2026-7168
  * debian/rules: run test suite with extra debugging information.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 29 Apr 2026 07:35:43 -0400

curl (7.81.0-1ubuntu1.23) jammy-security; urgency=medium

  * SECURITY UPDATE: bad reuse of HTTP Negotiate connection
    - debian/patches/CVE-2026-1965-1.patch: fix reuse of connections using
      HTTP Negotiate in lib/url.c.
    - debian/patches/CVE-2026-1965-2.patch: fix copy and paste
      url_match_auth_nego mistake in lib/url.c.
    - CVE-2026-1965
  * SECURITY UPDATE: token leak with redirect and netrc
    - debian/patches/CVE-2026-3783.patch: only send bearer if auth is
      allowed in lib/http.c, tests/data/Makefile.inc, tests/data/test2006.
    - CVE-2026-3783
  * SECURITY UPDATE: wrong proxy connection reuse with credentials
    - debian/patches/CVE-2026-3784.patch: add additional tests in
      lib/url.c.
    - CVE-2026-3784
  * SECURITY UPDATE: netrc and default credential leak
    - debian/patches/CVE-2025-0167.patch: 'default' with no credentials is
      not a match in lib/netrc.c, tests/data/Makefile.inc,
      tests/data/test486.
    - CVE-2025-0167

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 10 Mar 2026 14:25:36 -0400

curl (7.81.0-1ubuntu1.22) jammy-security; urgency=medium

  * SECURITY UPDATE: multi-threaded TSL options leak
    - debian/patches/CVE-2025-14017.patch: call ldap_init() before
    setting the options in lib/ldap.c
    - CVE-2025-14017
  * SECURITY UPDATE: bearer token leak on cross-protocol redirect
    - debian/patches/CVE-2025-14524.patch: if redirected,
    require permission to use bearer in lib/curl_sasl.c
    - CVE-2025-14524
  * SECURITY UPDATE: ssh known_hosts validation bypass
    - debian/patches/CVE-2025-15079.patch: set both knownhosts
    options to the same file in lib/vssh/libssh.c
    - CVE-2025-15079
  * SECURITY UPDATE: improper local ssh agent authentication
    - debian/patches/CVE-2025-15224.patch: require private key
    or user-agent for public key auth in lib/vssh/libssh.c
    - CVE-2025-15224

 -- Elise Hlady <elise.hlady@canonical.com>  Wed, 18 Feb 2026 13:33:48 -0800

curl (7.81.0-1ubuntu1.21) jammy-security; urgency=medium

  * SECURITY REGRESSION: incorrect Cookie header field size check
    (LP: #2118865)
    - debian/patches/CVE-2022-32205-2.patch: rectify the field size check
      in lib/http.c.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 23 Sep 2025 07:24:37 -0400

curl (7.81.0-1ubuntu1.20) jammy-security; urgency=medium

  * SECURITY UPDATE: netrc and redirect credential leak
    - debian/patches/CVE-2024-11053-pre1.patch: use same credentials on
      redirect in lib/transfer.c, lib/url.c, lib/urldata.h,
      tests/data/Makefile.inc, tests/data/test998, tests/data/test999.
    - debian/patches/CVE-2024-11053.patch: address several netrc parser
      flaws in lib/netrc.c, lib/url.c, tests/data/Makefile.inc,
      tests/data/test478, tests/data/test479, tests/data/test480,
      tests/unit/unit1304.c, tests/data/DISABLED.
    - CVE-2024-11053

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 11 Dec 2024 12:26:37 -0500

curl (7.81.0-1ubuntu1.19) jammy-security; urgency=medium

  * SECURITY UPDATE: HSTS expiry overwrites parent cache entry.
    - debian/patches/CVE-2024-9681.patch: Add bestsub, blen, and hostname
      comparison in lib/hsts.c.
    - CVE-2024-9681

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Wed, 06 Nov 2024 10:54:59 -0330

curl (7.81.0-1ubuntu1.18) jammy-security; urgency=medium

  * SECURITY UPDATE: OCSP stapling bypass with GnuTLS
    - debian/patches/CVE-2024-8096.patch: fix OCSP stapling management in
      lib/vtls/gtls.c.
    - CVE-2024-8096

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 06 Sep 2024 07:38:40 -0400

curl (7.81.0-1ubuntu1.17) jammy-security; urgency=medium

  * SECURITY UPDATE: ASN.1 date parser overread
    - debian/patches/CVE-2024-7264-pre1.patch: clean up GTime2str in
      lib/x509asn1.c.
    - debian/patches/CVE-2024-7264.patch: unittests and fixes for gtime2str
      in lib/x509asn1.c, lib/x509asn1.h, tests/data/Makefile.inc,
      tests/data/test1656, tests/unit/Makefile.inc, tests/unit/unit1656.c.
    - CVE-2024-7264

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 01 Aug 2024 09:51:30 -0400

curl (7.81.0-1ubuntu1.16) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 push headers memory-leak
    - debian/patches/CVE-2024-2398.patch: push headers better cleanup in
      lib/http2.c.
    - CVE-2024-2398

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 19 Mar 2024 08:16:19 -0400

# For older changelog entries, run 'apt-get changelog libcurl3-nss'
