4.25. curl
An updated curl package that fixes a bug is now available for Red Hat Enterprise Linux 5.
The curl package provides the libcurl library and the cURL command line tool for transferring data using various protocols, including FTP, HTTP, Gopher, Telnet, and DICT. Both, libcurl and cURL, support many useful capabilities, such as user authentication, proxy support, FTP uploading, HTTP POST and PUT methods, SSL certificates, and file transfer resume.
Bug Fix
- BZ#727884
- As a solution to a security issue, GSSAPI credential delegation was disabled, which broke the functionality of the applications that were relying on delegation, which was incorrectly enabled by libcurl. To fix this issue, the CURLOPT_GSSAPI_DELEGATION libcurl option has been introduced in order to enable delegation explicitly when applications need it. All applications using GSSAPI credential delegation can now use this new libcurl option to be able to run properly.
All users of cURL and libcurl are advised to upgrade to this updated package, which resolves this issue. All running applications using libcurl have to be restarted for the update to take an effect.
An updated curl package that fixes multiple bugs and adds two enhancements is now available for Red Hat Enterprise Linux 5.
The curl package provides the libcurl library and the cURL command line tool for transferring data using various protocols, including FTP, HTTP, Gopher, Telnet, and DICT. Both, libcurl and cURL, support many useful capabilities, such as user authentication, proxy support, FTP uploading, HTTP POST and PUT methods, SSL certificates, and file transfer resume.
Bug Fixes
- BZ#652557
- In the FTP implementation, libcurl incorrectly called the accept() function from a system library, which caused a stack overflow under certain circumstances. This update applies a backported upstream patch that corrects this bug, and the stack overflow no longer occurs.
- BZ#655073
- Previously, an attempt to send an LDAP request through an HTTP proxy tunnel ended up with cURL trying to connect to the LDAP server directly using a wrong port number. With this update, the underlying source code has been modified to fix this problem, and cURL now works as expected.
- BZ#688871
- Previously, the "multi" interface of libcurl was broken, which caused the "git push" command to work incorrectly over the Web Distributed Authoring and Versioning (WebDAV) protocol. This update applies an upstream patch, which corrects counting of active connections in the "multi" interface. The "git push" command now works as expected over WebDAV.
- BZ#723643
- As a solution to a security issue, GSSAPI credential delegation was disabled, which broke the functionality of the applications that were relying on delegation, which was incorrectly enabled by libcurl. To fix this problem, the CURLOPT_GSSAPI_DELEGATION libcurl option has been introduced in order to enable delegation explicitly when applications need it. All applications using GSSAPI credential delegation can now use this new libcurl option to be able to run properly.
Enhancements
- BZ#657396
- Previously, curl did not support proxy authentication using Kerberos. With this update, underlying code has been modified and curl now allows Kerberos proxy authentication by using the "--proxy-negotiate" option.
- BZ#746849
- The cURL utility did not allow Kerberos credential delegation although the libcurl library provided appropriate support for this functionality. This update introduces a new option, "--delegation", which enables Kerberos credential delegation in cURL.
All users of curl are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements. All running applications that use libcurl have to be restarted for this update to take effect.
