Re: CVE Request -- cURL/libCURL 7.20.0

[Vincent Danen <vdanen () redhat com>]

> Hi Steve, vendors,
>
>   cURL upstream has released latest v7.20.0 version of cURL/libCURL
> fixing the "libcurl data callback excessive length" issue.
>
> References:
> [1] http://curl.haxx.se/docs/security.html#20100209
> [2] http://curl.haxx.se/docs/adv_20100209.html
> [3] http://curl.haxx.se/libcurl-contentencoding.patch
> [4] http://curl.haxx.se/download.html
>
> Mitigation factors (from [1]):
>
> "This error is only present in zlib-enabled builds of libcurl and only if
>  automatic decompression has been explicitly enabled by the application - it
>  is disabled by default."
>
> Could you allocate CVE id for this?

Please use CVE-2010-0734 for this issue.

--
Vincent Danen / Red Hat Security Response Team