Vulnerability-Lookup

CVE-2025-14524 (GCVE-0-2025-14524)

Vulnerability from cvelistv5 – Published: 2026-01-08 10:07 – Updated: 2026-04-02 13:20

Title

bearer token leak on cross-protocol redirect

Summary

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-522 Insufficiently Protected Credentials

Assigner

curl

References

3 references

URL	Tags
https://curl.se/docs/CVE-2025-14524.json
https://curl.se/docs/CVE-2025-14524.html
https://hackerone.com/reports/3459417

Impacted products

1 product

Vendor	Product	Version
curl	curl	Affected: 8.17.0 , ≤ 8.17.0 (semver) Affected: 8.16.0 , ≤ 8.16.0 (semver) Affected: 8.15.0 , ≤ 8.15.0 (semver) Affected: 8.14.1 , ≤ 8.14.1 (semver) Affected: 8.14.0 , ≤ 8.14.0 (semver) Affected: 8.13.0 , ≤ 8.13.0 (semver) Affected: 8.12.1 , ≤ 8.12.1 (semver) Affected: 8.12.0 , ≤ 8.12.0 (semver) Affected: 8.11.1 , ≤ 8.11.1 (semver) Affected: 8.11.0 , ≤ 8.11.0 (semver) Affected: 8.10.1 , ≤ 8.10.1 (semver) Affected: 8.10.0 , ≤ 8.10.0 (semver) Affected: 8.9.1 , ≤ 8.9.1 (semver) Affected: 8.9.0 , ≤ 8.9.0 (semver) Affected: 8.8.0 , ≤ 8.8.0 (semver) Affected: 8.7.1 , ≤ 8.7.1 (semver) Affected: 8.7.0 , ≤ 8.7.0 (semver) Affected: 8.6.0 , ≤ 8.6.0 (semver) Affected: 8.5.0 , ≤ 8.5.0 (semver) Affected: 8.4.0 , ≤ 8.4.0 (semver) Affected: 8.3.0 , ≤ 8.3.0 (semver) Affected: 8.2.1 , ≤ 8.2.1 (semver) Affected: 8.2.0 , ≤ 8.2.0 (semver) Affected: 8.1.2 , ≤ 8.1.2 (semver) Affected: 8.1.1 , ≤ 8.1.1 (semver) Affected: 8.1.0 , ≤ 8.1.0 (semver) Affected: 8.0.1 , ≤ 8.0.1 (semver) Affected: 8.0.0 , ≤ 8.0.0 (semver) Affected: 7.88.1 , ≤ 7.88.1 (semver) Affected: 7.88.0 , ≤ 7.88.0 (semver) Affected: 7.87.0 , ≤ 7.87.0 (semver) Affected: 7.86.0 , ≤ 7.86.0 (semver) Affected: 7.85.0 , ≤ 7.85.0 (semver) Affected: 7.84.0 , ≤ 7.84.0 (semver) Affected: 7.83.1 , ≤ 7.83.1 (semver) Affected: 7.83.0 , ≤ 7.83.0 (semver) Affected: 7.82.0 , ≤ 7.82.0 (semver) Affected: 7.81.0 , ≤ 7.81.0 (semver) Affected: 7.80.0 , ≤ 7.80.0 (semver) Affected: 7.79.1 , ≤ 7.79.1 (semver) Affected: 7.79.0 , ≤ 7.79.0 (semver) Affected: 7.78.0 , ≤ 7.78.0 (semver) Affected: 7.77.0 , ≤ 7.77.0 (semver) Affected: 7.76.1 , ≤ 7.76.1 (semver) Affected: 7.76.0 , ≤ 7.76.0 (semver) Affected: 7.75.0 , ≤ 7.75.0 (semver) Affected: 7.74.0 , ≤ 7.74.0 (semver) Affected: 7.73.0 , ≤ 7.73.0 (semver) Affected: 7.72.0 , ≤ 7.72.0 (semver) Affected: 7.71.1 , ≤ 7.71.1 (semver) Affected: 7.71.0 , ≤ 7.71.0 (semver) Affected: 7.70.0 , ≤ 7.70.0 (semver) Affected: 7.69.1 , ≤ 7.69.1 (semver) Affected: 7.69.0 , ≤ 7.69.0 (semver) Affected: 7.68.0 , ≤ 7.68.0 (semver) Affected: 7.67.0 , ≤ 7.67.0 (semver) Affected: 7.66.0 , ≤ 7.66.0 (semver) Affected: 7.65.3 , ≤ 7.65.3 (semver) Affected: 7.65.2 , ≤ 7.65.2 (semver) Affected: 7.65.1 , ≤ 7.65.1 (semver) Affected: 7.65.0 , ≤ 7.65.0 (semver) Affected: 7.64.1 , ≤ 7.64.1 (semver) Affected: 7.64.0 , ≤ 7.64.0 (semver) Affected: 7.63.0 , ≤ 7.63.0 (semver) Affected: 7.62.0 , ≤ 7.62.0 (semver) Affected: 7.61.1 , ≤ 7.61.1 (semver) Affected: 7.61.0 , ≤ 7.61.0 (semver) Affected: 7.60.0 , ≤ 7.60.0 (semver) Affected: 7.59.0 , ≤ 7.59.0 (semver) Affected: 7.58.0 , ≤ 7.58.0 (semver) Affected: 7.57.0 , ≤ 7.57.0 (semver) Affected: 7.56.1 , ≤ 7.56.1 (semver) Affected: 7.56.0 , ≤ 7.56.0 (semver) Affected: 7.55.1 , ≤ 7.55.1 (semver) Affected: 7.55.0 , ≤ 7.55.0 (semver) Affected: 7.54.1 , ≤ 7.54.1 (semver) Affected: 7.54.0 , ≤ 7.54.0 (semver) Affected: 7.53.1 , ≤ 7.53.1 (semver) Affected: 7.53.0 , ≤ 7.53.0 (semver) Affected: 7.52.1 , ≤ 7.52.1 (semver) Affected: 7.52.0 , ≤ 7.52.0 (semver) Affected: 7.51.0 , ≤ 7.51.0 (semver) Affected: 7.50.3 , ≤ 7.50.3 (semver) Affected: 7.50.2 , ≤ 7.50.2 (semver) Affected: 7.50.1 , ≤ 7.50.1 (semver) Affected: 7.50.0 , ≤ 7.50.0 (semver) Affected: 7.49.1 , ≤ 7.49.1 (semver) Affected: 7.49.0 , ≤ 7.49.0 (semver) Affected: 7.48.0 , ≤ 7.48.0 (semver) Affected: 7.47.1 , ≤ 7.47.1 (semver) Affected: 7.47.0 , ≤ 7.47.0 (semver) Affected: 7.46.0 , ≤ 7.46.0 (semver) Affected: 7.45.0 , ≤ 7.45.0 (semver) Affected: 7.44.0 , ≤ 7.44.0 (semver) Affected: 7.43.0 , ≤ 7.43.0 (semver) Affected: 7.42.1 , ≤ 7.42.1 (semver) Affected: 7.42.0 , ≤ 7.42.0 (semver) Affected: 7.41.0 , ≤ 7.41.0 (semver) Affected: 7.40.0 , ≤ 7.40.0 (semver) Affected: 7.39.0 , ≤ 7.39.0 (semver) Affected: 7.38.0 , ≤ 7.38.0 (semver) Affected: 7.37.1 , ≤ 7.37.1 (semver) Affected: 7.37.0 , ≤ 7.37.0 (semver) Affected: 7.36.0 , ≤ 7.36.0 (semver) Affected: 7.35.0 , ≤ 7.35.0 (semver) Affected: 7.34.0 , ≤ 7.34.0 (semver) Affected: 7.33.0 , ≤ 7.33.0 (semver)

Credits

anonymous237 on hackerone Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-08T11:06:18.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/07/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14524",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-09T19:24:54.231955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T13:20:16.344Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.17.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.16.0",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.15.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.1",
              "status": "affected",
              "version": "8.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.0",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.13.0",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.1",
              "status": "affected",
              "version": "8.12.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0",
              "status": "affected",
              "version": "8.12.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.1",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.0",
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.1",
              "status": "affected",
              "version": "8.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.1",
              "status": "affected",
              "version": "8.9.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.0",
              "status": "affected",
              "version": "8.9.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.8.0",
              "status": "affected",
              "version": "8.8.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.1",
              "status": "affected",
              "version": "8.7.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.0",
              "status": "affected",
              "version": "8.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.6.0",
              "status": "affected",
              "version": "8.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.0",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.4.0",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.3.0",
              "status": "affected",
              "version": "8.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.1",
              "status": "affected",
              "version": "8.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.0",
              "status": "affected",
              "version": "8.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.2",
              "status": "affected",
              "version": "8.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.1",
              "status": "affected",
              "version": "8.1.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.0",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.1",
              "status": "affected",
              "version": "7.88.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.0",
              "status": "affected",
              "version": "7.88.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.87.0",
              "status": "affected",
              "version": "7.87.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.86.0",
              "status": "affected",
              "version": "7.86.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.85.0",
              "status": "affected",
              "version": "7.85.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.84.0",
              "status": "affected",
              "version": "7.84.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.1",
              "status": "affected",
              "version": "7.83.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.0",
              "status": "affected",
              "version": "7.83.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.82.0",
              "status": "affected",
              "version": "7.82.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.81.0",
              "status": "affected",
              "version": "7.81.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.80.0",
              "status": "affected",
              "version": "7.80.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.1",
              "status": "affected",
              "version": "7.79.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.0",
              "status": "affected",
              "version": "7.79.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.78.0",
              "status": "affected",
              "version": "7.78.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.77.0",
              "status": "affected",
              "version": "7.77.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.1",
              "status": "affected",
              "version": "7.76.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.0",
              "status": "affected",
              "version": "7.76.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.75.0",
              "status": "affected",
              "version": "7.75.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.74.0",
              "status": "affected",
              "version": "7.74.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.73.0",
              "status": "affected",
              "version": "7.73.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.72.0",
              "status": "affected",
              "version": "7.72.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.1",
              "status": "affected",
              "version": "7.71.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.0",
              "status": "affected",
              "version": "7.71.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.70.0",
              "status": "affected",
              "version": "7.70.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.1",
              "status": "affected",
              "version": "7.69.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.0",
              "status": "affected",
              "version": "7.69.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.68.0",
              "status": "affected",
              "version": "7.68.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.67.0",
              "status": "affected",
              "version": "7.67.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.66.0",
              "status": "affected",
              "version": "7.66.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.3",
              "status": "affected",
              "version": "7.65.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.2",
              "status": "affected",
              "version": "7.65.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.1",
              "status": "affected",
              "version": "7.65.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.0",
              "status": "affected",
              "version": "7.65.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.64.1",
              "status": "affected",
              "version": "7.64.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.64.0",
              "status": "affected",
              "version": "7.64.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.63.0",
              "status": "affected",
              "version": "7.63.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.62.0",
              "status": "affected",
              "version": "7.62.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.61.1",
              "status": "affected",
              "version": "7.61.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.61.0",
              "status": "affected",
              "version": "7.61.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.60.0",
              "status": "affected",
              "version": "7.60.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.59.0",
              "status": "affected",
              "version": "7.59.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.58.0",
              "status": "affected",
              "version": "7.58.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.57.0",
              "status": "affected",
              "version": "7.57.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.56.1",
              "status": "affected",
              "version": "7.56.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.56.0",
              "status": "affected",
              "version": "7.56.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.55.1",
              "status": "affected",
              "version": "7.55.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.55.0",
              "status": "affected",
              "version": "7.55.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.54.1",
              "status": "affected",
              "version": "7.54.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.54.0",
              "status": "affected",
              "version": "7.54.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.53.1",
              "status": "affected",
              "version": "7.53.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.53.0",
              "status": "affected",
              "version": "7.53.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.52.1",
              "status": "affected",
              "version": "7.52.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.52.0",
              "status": "affected",
              "version": "7.52.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.51.0",
              "status": "affected",
              "version": "7.51.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.3",
              "status": "affected",
              "version": "7.50.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.2",
              "status": "affected",
              "version": "7.50.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.1",
              "status": "affected",
              "version": "7.50.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.0",
              "status": "affected",
              "version": "7.50.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.49.1",
              "status": "affected",
              "version": "7.49.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.49.0",
              "status": "affected",
              "version": "7.49.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.48.0",
              "status": "affected",
              "version": "7.48.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.47.1",
              "status": "affected",
              "version": "7.47.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.47.0",
              "status": "affected",
              "version": "7.47.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.46.0",
              "status": "affected",
              "version": "7.46.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.45.0",
              "status": "affected",
              "version": "7.45.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.44.0",
              "status": "affected",
              "version": "7.44.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.43.0",
              "status": "affected",
              "version": "7.43.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.42.1",
              "status": "affected",
              "version": "7.42.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.42.0",
              "status": "affected",
              "version": "7.42.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.41.0",
              "status": "affected",
              "version": "7.41.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.40.0",
              "status": "affected",
              "version": "7.40.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.39.0",
              "status": "affected",
              "version": "7.39.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.38.0",
              "status": "affected",
              "version": "7.38.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.37.1",
              "status": "affected",
              "version": "7.37.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.37.0",
              "status": "affected",
              "version": "7.37.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.36.0",
              "status": "affected",
              "version": "7.36.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.35.0",
              "status": "affected",
              "version": "7.35.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.34.0",
              "status": "affected",
              "version": "7.34.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.33.0",
              "status": "affected",
              "version": "7.33.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "anonymous237 on hackerone"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-08T10:07:25.655Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "name": "json",
          "url": "https://curl.se/docs/CVE-2025-14524.json"
        },
        {
          "name": "www",
          "url": "https://curl.se/docs/CVE-2025-14524.html"
        },
        {
          "name": "issue",
          "url": "https://hackerone.com/reports/3459417"
        }
      ],
      "title": "bearer token leak on cross-protocol redirect"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-14524",
    "datePublished": "2026-01-08T10:07:25.655Z",
    "dateReserved": "2025-12-11T08:04:14.328Z",
    "dateUpdated": "2026-04-02T13:20:16.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-14524",
      "date": "2026-05-23",
      "epss": "0.0004",
      "percentile": "0.12391"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-14524\",\"sourceIdentifier\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"published\":\"2026-01-08T10:15:46.607\",\"lastModified\":\"2026-01-20T14:53:11.017\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\\ntarget host.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-601\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.33.0\",\"versionEndExcluding\":\"8.18.0\",\"matchCriteriaId\":\"A68C0C39-B32A-4FED-A179-1BF16B8E0E1C\"}]}]}],\"references\":[{\"url\":\"https://curl.se/docs/CVE-2025-14524.html\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Vendor Advisory\",\"Patch\"]},{\"url\":\"https://curl.se/docs/CVE-2025-14524.json\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://hackerone.com/reports/3459417\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/01/07/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\",\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/01/07/4\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-01-08T11:06:18.117Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-14524\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-09T19:24:54.231955Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-09T19:25:18.454Z\"}}], \"cna\": {\"title\": \"bearer token leak on cross-protocol redirect\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"anonymous237 on hackerone\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Daniel Stenberg\"}], \"affected\": [{\"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.17.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.17.0\"}, {\"status\": \"affected\", \"version\": \"8.16.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.16.0\"}, {\"status\": \"affected\", \"version\": \"8.15.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.15.0\"}, {\"status\": \"affected\", \"version\": \"8.14.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.14.1\"}, {\"status\": \"affected\", \"version\": \"8.14.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.14.0\"}, {\"status\": \"affected\", \"version\": \"8.13.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.13.0\"}, {\"status\": \"affected\", \"version\": \"8.12.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.12.1\"}, {\"status\": \"affected\", \"version\": \"8.12.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.12.0\"}, {\"status\": \"affected\", \"version\": \"8.11.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.11.1\"}, {\"status\": \"affected\", \"version\": \"8.11.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.11.0\"}, {\"status\": \"affected\", \"version\": \"8.10.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.1\"}, {\"status\": \"affected\", \"version\": \"8.10.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.0\"}, {\"status\": \"affected\", \"version\": \"8.9.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.9.1\"}, {\"status\": \"affected\", \"version\": \"8.9.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.9.0\"}, {\"status\": \"affected\", \"version\": \"8.8.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.8.0\"}, {\"status\": \"affected\", \"version\": \"8.7.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.7.1\"}, {\"status\": \"affected\", \"version\": \"8.7.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.7.0\"}, {\"status\": \"affected\", \"version\": \"8.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.6.0\"}, {\"status\": \"affected\", \"version\": \"8.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.5.0\"}, {\"status\": \"affected\", \"version\": \"8.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.4.0\"}, {\"status\": \"affected\", \"version\": \"8.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.3.0\"}, {\"status\": \"affected\", \"version\": \"8.2.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.1\"}, {\"status\": \"affected\", \"version\": \"8.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.0\"}, {\"status\": \"affected\", \"version\": \"8.1.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.2\"}, {\"status\": \"affected\", \"version\": \"8.1.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.1\"}, {\"status\": \"affected\", \"version\": \"8.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.0\"}, {\"status\": \"affected\", \"version\": \"8.0.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.0.1\"}, {\"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.0.0\"}, {\"status\": \"affected\", \"version\": \"7.88.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.88.1\"}, {\"status\": \"affected\", \"version\": \"7.88.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.88.0\"}, {\"status\": \"affected\", \"version\": \"7.87.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.87.0\"}, {\"status\": \"affected\", \"version\": \"7.86.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.86.0\"}, {\"status\": \"affected\", \"version\": \"7.85.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.85.0\"}, {\"status\": \"affected\", \"version\": \"7.84.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.84.0\"}, {\"status\": \"affected\", \"version\": \"7.83.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.83.1\"}, {\"status\": \"affected\", \"version\": \"7.83.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.83.0\"}, {\"status\": \"affected\", \"version\": \"7.82.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.82.0\"}, {\"status\": \"affected\", \"version\": \"7.81.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.81.0\"}, {\"status\": \"affected\", \"version\": \"7.80.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.80.0\"}, {\"status\": \"affected\", \"version\": \"7.79.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.79.1\"}, {\"status\": \"affected\", \"version\": \"7.79.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.79.0\"}, {\"status\": \"affected\", \"version\": \"7.78.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.78.0\"}, {\"status\": \"affected\", \"version\": \"7.77.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.77.0\"}, {\"status\": \"affected\", \"version\": \"7.76.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.76.1\"}, {\"status\": \"affected\", \"version\": \"7.76.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.76.0\"}, {\"status\": \"affected\", \"version\": \"7.75.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.75.0\"}, {\"status\": \"affected\", \"version\": \"7.74.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.74.0\"}, {\"status\": \"affected\", \"version\": \"7.73.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.73.0\"}, {\"status\": \"affected\", \"version\": \"7.72.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.72.0\"}, {\"status\": \"affected\", \"version\": \"7.71.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.71.1\"}, {\"status\": \"affected\", \"version\": \"7.71.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.71.0\"}, {\"status\": \"affected\", \"version\": \"7.70.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.70.0\"}, {\"status\": \"affected\", \"version\": \"7.69.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.69.1\"}, {\"status\": \"affected\", \"version\": \"7.69.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.69.0\"}, {\"status\": \"affected\", \"version\": \"7.68.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.68.0\"}, {\"status\": \"affected\", \"version\": \"7.67.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.67.0\"}, {\"status\": \"affected\", \"version\": \"7.66.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.66.0\"}, {\"status\": \"affected\", \"version\": \"7.65.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.3\"}, {\"status\": \"affected\", \"version\": \"7.65.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.2\"}, {\"status\": \"affected\", \"version\": \"7.65.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.1\"}, {\"status\": \"affected\", \"version\": \"7.65.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.0\"}, {\"status\": \"affected\", \"version\": \"7.64.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.64.1\"}, {\"status\": \"affected\", \"version\": \"7.64.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.64.0\"}, {\"status\": \"affected\", \"version\": \"7.63.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.63.0\"}, {\"status\": \"affected\", \"version\": \"7.62.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.62.0\"}, {\"status\": \"affected\", \"version\": \"7.61.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.61.1\"}, {\"status\": \"affected\", \"version\": \"7.61.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.61.0\"}, {\"status\": \"affected\", \"version\": \"7.60.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.60.0\"}, {\"status\": \"affected\", \"version\": \"7.59.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.59.0\"}, {\"status\": \"affected\", \"version\": \"7.58.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.58.0\"}, {\"status\": \"affected\", \"version\": \"7.57.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.57.0\"}, {\"status\": \"affected\", \"version\": \"7.56.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.56.1\"}, {\"status\": \"affected\", \"version\": \"7.56.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.56.0\"}, {\"status\": \"affected\", \"version\": \"7.55.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.55.1\"}, {\"status\": \"affected\", \"version\": \"7.55.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.55.0\"}, {\"status\": \"affected\", \"version\": \"7.54.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.54.1\"}, {\"status\": \"affected\", \"version\": \"7.54.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.54.0\"}, {\"status\": \"affected\", \"version\": \"7.53.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.53.1\"}, {\"status\": \"affected\", \"version\": \"7.53.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.53.0\"}, {\"status\": \"affected\", \"version\": \"7.52.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.52.1\"}, {\"status\": \"affected\", \"version\": \"7.52.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.52.0\"}, {\"status\": \"affected\", \"version\": \"7.51.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.51.0\"}, {\"status\": \"affected\", \"version\": \"7.50.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.3\"}, {\"status\": \"affected\", \"version\": \"7.50.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.2\"}, {\"status\": \"affected\", \"version\": \"7.50.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.1\"}, {\"status\": \"affected\", \"version\": \"7.50.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.0\"}, {\"status\": \"affected\", \"version\": \"7.49.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.49.1\"}, {\"status\": \"affected\", \"version\": \"7.49.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.49.0\"}, {\"status\": \"affected\", \"version\": \"7.48.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.48.0\"}, {\"status\": \"affected\", \"version\": \"7.47.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.47.1\"}, {\"status\": \"affected\", \"version\": \"7.47.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.47.0\"}, {\"status\": \"affected\", \"version\": \"7.46.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.46.0\"}, {\"status\": \"affected\", \"version\": \"7.45.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.45.0\"}, {\"status\": \"affected\", \"version\": \"7.44.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.44.0\"}, {\"status\": \"affected\", \"version\": \"7.43.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.43.0\"}, {\"status\": \"affected\", \"version\": \"7.42.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.42.1\"}, {\"status\": \"affected\", \"version\": \"7.42.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.42.0\"}, {\"status\": \"affected\", \"version\": \"7.41.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.41.0\"}, {\"status\": \"affected\", \"version\": \"7.40.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.40.0\"}, {\"status\": \"affected\", \"version\": \"7.39.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.39.0\"}, {\"status\": \"affected\", \"version\": \"7.38.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.38.0\"}, {\"status\": \"affected\", \"version\": \"7.37.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.37.1\"}, {\"status\": \"affected\", \"version\": \"7.37.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.37.0\"}, {\"status\": \"affected\", \"version\": \"7.36.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.36.0\"}, {\"status\": \"affected\", \"version\": \"7.35.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.35.0\"}, {\"status\": \"affected\", \"version\": \"7.34.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.34.0\"}, {\"status\": \"affected\", \"version\": \"7.33.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.33.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://curl.se/docs/CVE-2025-14524.json\", \"name\": \"json\"}, {\"url\": \"https://curl.se/docs/CVE-2025-14524.html\", \"name\": \"www\"}, {\"url\": \"https://hackerone.com/reports/3459417\", \"name\": \"issue\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\\ntarget host.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-522 Insufficiently Protected Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"shortName\": \"curl\", \"dateUpdated\": \"2026-01-08T10:07:25.655Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-14524\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-02T13:20:16.344Z\", \"dateReserved\": \"2025-12-11T08:04:14.328Z\", \"assignerOrgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"datePublished\": \"2026-01-08T10:07:25.655Z\", \"assignerShortName\": \"curl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

SUSE-SU-2026:0051-1

Vulnerability from csaf_suse - Published: 2026-01-07 09:28 - Updated: 2026-01-07 09:28

Summary

Security update for curl

Severity

Moderate

Notes

Title of the patch: Security update for curl

Description of the patch: This update for curl fixes the following issues: - CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731). - CVE-2025-14819: libssh global knownhost override (bsc#1255732). - CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733). - CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

Patchnames: SUSE-2026-51,SUSE-SUSE-MicroOS-5.2-2026-51

CVE-2025-14524

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14819

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15079

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15224

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

20 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1255731	self
https://bugzilla.suse.com/1255732	self
https://bugzilla.suse.com/1255733	self
https://bugzilla.suse.com/1255734	self
https://www.suse.com/security/cve/CVE-2025-14524/	self
https://www.suse.com/security/cve/CVE-2025-14819/	self
https://www.suse.com/security/cve/CVE-2025-15079/	self
https://www.suse.com/security/cve/CVE-2025-15224/	self
https://www.suse.com/security/cve/CVE-2025-14524	external
https://bugzilla.suse.com/1255731	external
https://www.suse.com/security/cve/CVE-2025-14819	external
https://bugzilla.suse.com/1255732	external
https://www.suse.com/security/cve/CVE-2025-15079	external
https://bugzilla.suse.com/1255733	external
https://www.suse.com/security/cve/CVE-2025-15224	external
https://bugzilla.suse.com/1255734	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-51,SUSE-SUSE-MicroOS-5.2-2026-51",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0051-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0051-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260051-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0051-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023697.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-07T09:28:27Z",
      "generator": {
        "date": "2026-01-07T09:28:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0051-1",
      "initial_release_date": "2026-01-07T09:28:27Z",
      "revision_history": [
        {
          "date": "2026-01-07T09:28:27Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150200.4.97.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-150200.4.97.1.aarch64",
                  "product_id": "curl-8.14.1-150200.4.97.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150200.4.97.1.aarch64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150200.4.97.1.aarch64",
                  "product_id": "libcurl-devel-8.14.1-150200.4.97.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150200.4.97.1.aarch64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150200.4.97.1.aarch64",
                  "product_id": "libcurl-mini4-8.14.1-150200.4.97.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150200.4.97.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-150200.4.97.1.aarch64",
                  "product_id": "libcurl4-8.14.1-150200.4.97.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl-devel-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
                  "product_id": "libcurl-devel-64bit-8.14.1-150200.4.97.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl4-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
                  "product_id": "libcurl4-64bit-8.14.1-150200.4.97.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150200.4.97.1.i586",
                "product": {
                  "name": "curl-8.14.1-150200.4.97.1.i586",
                  "product_id": "curl-8.14.1-150200.4.97.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150200.4.97.1.i586",
                "product": {
                  "name": "libcurl-devel-8.14.1-150200.4.97.1.i586",
                  "product_id": "libcurl-devel-8.14.1-150200.4.97.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150200.4.97.1.i586",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150200.4.97.1.i586",
                  "product_id": "libcurl-mini4-8.14.1-150200.4.97.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150200.4.97.1.i586",
                "product": {
                  "name": "libcurl4-8.14.1-150200.4.97.1.i586",
                  "product_id": "libcurl4-8.14.1-150200.4.97.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-fish-completion-8.14.1-150200.4.97.1.noarch",
                "product": {
                  "name": "curl-fish-completion-8.14.1-150200.4.97.1.noarch",
                  "product_id": "curl-fish-completion-8.14.1-150200.4.97.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "curl-zsh-completion-8.14.1-150200.4.97.1.noarch",
                "product": {
                  "name": "curl-zsh-completion-8.14.1-150200.4.97.1.noarch",
                  "product_id": "curl-zsh-completion-8.14.1-150200.4.97.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-doc-8.14.1-150200.4.97.1.noarch",
                "product": {
                  "name": "libcurl-devel-doc-8.14.1-150200.4.97.1.noarch",
                  "product_id": "libcurl-devel-doc-8.14.1-150200.4.97.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150200.4.97.1.ppc64le",
                "product": {
                  "name": "curl-8.14.1-150200.4.97.1.ppc64le",
                  "product_id": "curl-8.14.1-150200.4.97.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150200.4.97.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-8.14.1-150200.4.97.1.ppc64le",
                  "product_id": "libcurl-devel-8.14.1-150200.4.97.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150200.4.97.1.ppc64le",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150200.4.97.1.ppc64le",
                  "product_id": "libcurl-mini4-8.14.1-150200.4.97.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150200.4.97.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.14.1-150200.4.97.1.ppc64le",
                  "product_id": "libcurl4-8.14.1-150200.4.97.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150200.4.97.1.s390x",
                "product": {
                  "name": "curl-8.14.1-150200.4.97.1.s390x",
                  "product_id": "curl-8.14.1-150200.4.97.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150200.4.97.1.s390x",
                "product": {
                  "name": "libcurl-devel-8.14.1-150200.4.97.1.s390x",
                  "product_id": "libcurl-devel-8.14.1-150200.4.97.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150200.4.97.1.s390x",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150200.4.97.1.s390x",
                  "product_id": "libcurl-mini4-8.14.1-150200.4.97.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150200.4.97.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-150200.4.97.1.s390x",
                  "product_id": "libcurl4-8.14.1-150200.4.97.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "curl-8.14.1-150200.4.97.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "libcurl-devel-8.14.1-150200.4.97.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-32bit-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "libcurl-devel-32bit-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "libcurl-devel-32bit-8.14.1-150200.4.97.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "libcurl-mini4-8.14.1-150200.4.97.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "libcurl4-8.14.1-150200.4.97.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-32bit-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "libcurl4-32bit-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "libcurl4-32bit-8.14.1-150200.4.97.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.2",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.2",
                  "product_id": "SUSE Linux Enterprise Micro 5.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-microos:5.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150200.4.97.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64"
        },
        "product_reference": "curl-8.14.1-150200.4.97.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150200.4.97.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x"
        },
        "product_reference": "curl-8.14.1-150200.4.97.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150200.4.97.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64"
        },
        "product_reference": "curl-8.14.1-150200.4.97.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150200.4.97.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-150200.4.97.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150200.4.97.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-150200.4.97.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150200.4.97.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-150200.4.97.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing TLS related transfers with reused easy or multi handles and\naltering the  `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

SUSE-SU-2026:0052-1

Vulnerability from csaf_suse - Published: 2026-01-07 09:28 - Updated: 2026-01-07 09:28

Summary

Security update for curl

Severity

Moderate

Notes

Title of the patch: Security update for curl

Patchnames: SUSE-2026-52,SUSE-SLE-Module-Basesystem-15-SP7-2026-52

CVE-2025-14524

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 13 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14819

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 13 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15079

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 13 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15224

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 13 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

20 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1255731	self
https://bugzilla.suse.com/1255732	self
https://bugzilla.suse.com/1255733	self
https://bugzilla.suse.com/1255734	self
https://www.suse.com/security/cve/CVE-2025-14524/	self
https://www.suse.com/security/cve/CVE-2025-14819/	self
https://www.suse.com/security/cve/CVE-2025-15079/	self
https://www.suse.com/security/cve/CVE-2025-15224/	self
https://www.suse.com/security/cve/CVE-2025-14524	external
https://bugzilla.suse.com/1255731	external
https://www.suse.com/security/cve/CVE-2025-14819	external
https://bugzilla.suse.com/1255732	external
https://www.suse.com/security/cve/CVE-2025-15079	external
https://bugzilla.suse.com/1255733	external
https://www.suse.com/security/cve/CVE-2025-15224	external
https://bugzilla.suse.com/1255734	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-52,SUSE-SLE-Module-Basesystem-15-SP7-2026-52",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0052-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0052-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260052-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0052-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023696.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-07T09:28:37Z",
      "generator": {
        "date": "2026-01-07T09:28:37Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0052-1",
      "initial_release_date": "2026-01-07T09:28:37Z",
      "revision_history": [
        {
          "date": "2026-01-07T09:28:37Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150700.7.8.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-150700.7.8.1.aarch64",
                  "product_id": "curl-8.14.1-150700.7.8.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150700.7.8.1.aarch64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150700.7.8.1.aarch64",
                  "product_id": "libcurl-devel-8.14.1-150700.7.8.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150700.7.8.1.aarch64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150700.7.8.1.aarch64",
                  "product_id": "libcurl-mini4-8.14.1-150700.7.8.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150700.7.8.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-150700.7.8.1.aarch64",
                  "product_id": "libcurl4-8.14.1-150700.7.8.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl-devel-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
                  "product_id": "libcurl-devel-64bit-8.14.1-150700.7.8.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl4-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
                  "product_id": "libcurl4-64bit-8.14.1-150700.7.8.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150700.7.8.1.i586",
                "product": {
                  "name": "curl-8.14.1-150700.7.8.1.i586",
                  "product_id": "curl-8.14.1-150700.7.8.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150700.7.8.1.i586",
                "product": {
                  "name": "libcurl-devel-8.14.1-150700.7.8.1.i586",
                  "product_id": "libcurl-devel-8.14.1-150700.7.8.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150700.7.8.1.i586",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150700.7.8.1.i586",
                  "product_id": "libcurl-mini4-8.14.1-150700.7.8.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150700.7.8.1.i586",
                "product": {
                  "name": "libcurl4-8.14.1-150700.7.8.1.i586",
                  "product_id": "libcurl4-8.14.1-150700.7.8.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-fish-completion-8.14.1-150700.7.8.1.noarch",
                "product": {
                  "name": "curl-fish-completion-8.14.1-150700.7.8.1.noarch",
                  "product_id": "curl-fish-completion-8.14.1-150700.7.8.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "curl-zsh-completion-8.14.1-150700.7.8.1.noarch",
                "product": {
                  "name": "curl-zsh-completion-8.14.1-150700.7.8.1.noarch",
                  "product_id": "curl-zsh-completion-8.14.1-150700.7.8.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-doc-8.14.1-150700.7.8.1.noarch",
                "product": {
                  "name": "libcurl-devel-doc-8.14.1-150700.7.8.1.noarch",
                  "product_id": "libcurl-devel-doc-8.14.1-150700.7.8.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150700.7.8.1.ppc64le",
                "product": {
                  "name": "curl-8.14.1-150700.7.8.1.ppc64le",
                  "product_id": "curl-8.14.1-150700.7.8.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
                  "product_id": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150700.7.8.1.ppc64le",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150700.7.8.1.ppc64le",
                  "product_id": "libcurl-mini4-8.14.1-150700.7.8.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150700.7.8.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.14.1-150700.7.8.1.ppc64le",
                  "product_id": "libcurl4-8.14.1-150700.7.8.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150700.7.8.1.s390x",
                "product": {
                  "name": "curl-8.14.1-150700.7.8.1.s390x",
                  "product_id": "curl-8.14.1-150700.7.8.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150700.7.8.1.s390x",
                "product": {
                  "name": "libcurl-devel-8.14.1-150700.7.8.1.s390x",
                  "product_id": "libcurl-devel-8.14.1-150700.7.8.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150700.7.8.1.s390x",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150700.7.8.1.s390x",
                  "product_id": "libcurl-mini4-8.14.1-150700.7.8.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150700.7.8.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-150700.7.8.1.s390x",
                  "product_id": "libcurl4-8.14.1-150700.7.8.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "curl-8.14.1-150700.7.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "libcurl-devel-8.14.1-150700.7.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-32bit-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "libcurl-devel-32bit-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "libcurl-devel-32bit-8.14.1-150700.7.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "libcurl-mini4-8.14.1-150700.7.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "libcurl4-8.14.1-150700.7.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150700.7.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64"
        },
        "product_reference": "curl-8.14.1-150700.7.8.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150700.7.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le"
        },
        "product_reference": "curl-8.14.1-150700.7.8.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150700.7.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x"
        },
        "product_reference": "curl-8.14.1-150700.7.8.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64"
        },
        "product_reference": "curl-8.14.1-150700.7.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150700.7.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64"
        },
        "product_reference": "libcurl-devel-8.14.1-150700.7.8.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le"
        },
        "product_reference": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150700.7.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x"
        },
        "product_reference": "libcurl-devel-8.14.1-150700.7.8.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64"
        },
        "product_reference": "libcurl-devel-8.14.1-150700.7.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150700.7.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-150700.7.8.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150700.7.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le"
        },
        "product_reference": "libcurl4-8.14.1-150700.7.8.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150700.7.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-150700.7.8.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-150700.7.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64"
        },
        "product_reference": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing TLS related transfers with reused easy or multi handles and\naltering the  `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

SUSE-SU-2026:0066-1

Vulnerability from csaf_suse - Published: 2026-01-08 12:21 - Updated: 2026-01-08 12:21

Summary

Security update for curl

Severity

Moderate

Notes

Title of the patch: Security update for curl

Description of the patch: This update for curl fixes the following issues: - CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect (bsc#1255731) - CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile (bsc#1255733) - CVE-2025-14819: Fixed issue where alteration of CURLSSLOPT_NO_PARTIALCHAIN could accidentally lead to CA cache reuse for which partial chain was reversed (bsc#1255732)

Patchnames: SUSE-2026-66,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-66

CVE-2025-14524

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14819

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15079

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

16 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1255731	self
https://bugzilla.suse.com/1255732	self
https://bugzilla.suse.com/1255733	self
https://www.suse.com/security/cve/CVE-2025-14524/	self
https://www.suse.com/security/cve/CVE-2025-14819/	self
https://www.suse.com/security/cve/CVE-2025-15079/	self
https://www.suse.com/security/cve/CVE-2025-14524	external
https://bugzilla.suse.com/1255731	external
https://www.suse.com/security/cve/CVE-2025-14819	external
https://bugzilla.suse.com/1255732	external
https://www.suse.com/security/cve/CVE-2025-15079	external
https://bugzilla.suse.com/1255733	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\n  - CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect (bsc#1255731)\n  - CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile (bsc#1255733)\n  - CVE-2025-14819: Fixed issue where alteration of CURLSSLOPT_NO_PARTIALCHAIN could\n  accidentally lead to CA cache reuse for which partial chain was reversed (bsc#1255732)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-66,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-66",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0066-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0066-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260066-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0066-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023711.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-08T12:21:35Z",
      "generator": {
        "date": "2026-01-08T12:21:35Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0066-1",
      "initial_release_date": "2026-01-08T12:21:35Z",
      "revision_history": [
        {
          "date": "2026-01-08T12:21:35Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.aarch64",
                "product": {
                  "name": "curl-8.0.1-11.111.1.aarch64",
                  "product_id": "curl-8.0.1-11.111.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.aarch64",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.aarch64",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.aarch64",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.aarch64",
                  "product_id": "libcurl4-8.0.1-11.111.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-64bit-8.0.1-11.111.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl-devel-64bit-8.0.1-11.111.1.aarch64_ilp32",
                  "product_id": "libcurl-devel-64bit-8.0.1-11.111.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-64bit-8.0.1-11.111.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl4-64bit-8.0.1-11.111.1.aarch64_ilp32",
                  "product_id": "libcurl4-64bit-8.0.1-11.111.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.i586",
                "product": {
                  "name": "curl-8.0.1-11.111.1.i586",
                  "product_id": "curl-8.0.1-11.111.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.i586",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.i586",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.i586",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.i586",
                  "product_id": "libcurl4-8.0.1-11.111.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.ppc64le",
                "product": {
                  "name": "curl-8.0.1-11.111.1.ppc64le",
                  "product_id": "curl-8.0.1-11.111.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.ppc64le",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.ppc64le",
                  "product_id": "libcurl4-8.0.1-11.111.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.s390",
                "product": {
                  "name": "curl-8.0.1-11.111.1.s390",
                  "product_id": "curl-8.0.1-11.111.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.s390",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.s390",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.s390",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.s390",
                  "product_id": "libcurl4-8.0.1-11.111.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.s390x",
                "product": {
                  "name": "curl-8.0.1-11.111.1.s390x",
                  "product_id": "curl-8.0.1-11.111.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.s390x",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.s390x",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-32bit-8.0.1-11.111.1.s390x",
                "product": {
                  "name": "libcurl-devel-32bit-8.0.1-11.111.1.s390x",
                  "product_id": "libcurl-devel-32bit-8.0.1-11.111.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.s390x",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.s390x",
                  "product_id": "libcurl4-8.0.1-11.111.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-32bit-8.0.1-11.111.1.s390x",
                "product": {
                  "name": "libcurl4-32bit-8.0.1-11.111.1.s390x",
                  "product_id": "libcurl4-32bit-8.0.1-11.111.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.x86_64",
                "product": {
                  "name": "curl-8.0.1-11.111.1.x86_64",
                  "product_id": "curl-8.0.1-11.111.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.x86_64",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.x86_64",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-32bit-8.0.1-11.111.1.x86_64",
                "product": {
                  "name": "libcurl-devel-32bit-8.0.1-11.111.1.x86_64",
                  "product_id": "libcurl-devel-32bit-8.0.1-11.111.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.x86_64",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.x86_64",
                  "product_id": "libcurl4-8.0.1-11.111.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-32bit-8.0.1-11.111.1.x86_64",
                "product": {
                  "name": "libcurl4-32bit-8.0.1-11.111.1.x86_64",
                  "product_id": "libcurl4-32bit-8.0.1-11.111.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64"
        },
        "product_reference": "curl-8.0.1-11.111.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64"
        },
        "product_reference": "libcurl-devel-8.0.1-11.111.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
        },
        "product_reference": "libcurl4-8.0.1-11.111.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-32bit-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64"
        },
        "product_reference": "libcurl4-32bit-8.0.1-11.111.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T12:21:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing TLS related transfers with reused easy or multi handles and\naltering the  `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T12:21:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T12:21:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    }
  ]
}

SUSE-SU-2026:0508-1

Vulnerability from csaf_suse - Published: 2026-02-13 14:50 - Updated: 2026-02-13 14:50

Summary

Security update for curl

Severity

Moderate

Notes

Title of the patch: Security update for curl

Description of the patch: This update for curl fixes the following issues: - CVE-2025-14017: Fixed broken TLS options for threaded LDAPS (bsc#1256105). - CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731). - CVE-2025-14819: libssh global knownhost override (bsc#1255732). - CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733). - CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

Patchnames: SUSE-2026-508,SUSE-SLE-Micro-5.3-2026-508,SUSE-SLE-Micro-5.4-2026-508,SUSE-SLE-Micro-5.5-2026-508

CVE-2025-14017

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14524

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14819

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15079

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15224

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

24 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1255731	self
https://bugzilla.suse.com/1255732	self
https://bugzilla.suse.com/1255733	self
https://bugzilla.suse.com/1255734	self
https://bugzilla.suse.com/1256105	self
https://www.suse.com/security/cve/CVE-2025-14017/	self
https://www.suse.com/security/cve/CVE-2025-14524/	self
https://www.suse.com/security/cve/CVE-2025-14819/	self
https://www.suse.com/security/cve/CVE-2025-15079/	self
https://www.suse.com/security/cve/CVE-2025-15224/	self
https://www.suse.com/security/cve/CVE-2025-14017	external
https://bugzilla.suse.com/1256105	external
https://www.suse.com/security/cve/CVE-2025-14524	external
https://bugzilla.suse.com/1255731	external
https://www.suse.com/security/cve/CVE-2025-14819	external
https://bugzilla.suse.com/1255732	external
https://www.suse.com/security/cve/CVE-2025-15079	external
https://bugzilla.suse.com/1255733	external
https://www.suse.com/security/cve/CVE-2025-15224	external
https://bugzilla.suse.com/1255734	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\n- CVE-2025-14017: Fixed broken TLS options for threaded LDAPS (bsc#1256105).\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-508,SUSE-SLE-Micro-5.3-2026-508,SUSE-SLE-Micro-5.4-2026-508,SUSE-SLE-Micro-5.5-2026-508",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0508-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0508-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260508-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0508-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024240.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256105",
        "url": "https://bugzilla.suse.com/1256105"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14017 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14017/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-02-13T14:50:33Z",
      "generator": {
        "date": "2026-02-13T14:50:33Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0508-1",
      "initial_release_date": "2026-02-13T14:50:33Z",
      "revision_history": [
        {
          "date": "2026-02-13T14:50:33Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150400.5.77.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-150400.5.77.1.aarch64",
                  "product_id": "curl-8.14.1-150400.5.77.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150400.5.77.1.aarch64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150400.5.77.1.aarch64",
                  "product_id": "libcurl-devel-8.14.1-150400.5.77.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150400.5.77.1.aarch64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150400.5.77.1.aarch64",
                  "product_id": "libcurl-mini4-8.14.1-150400.5.77.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150400.5.77.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-150400.5.77.1.aarch64",
                  "product_id": "libcurl4-8.14.1-150400.5.77.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-64bit-8.14.1-150400.5.77.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl-devel-64bit-8.14.1-150400.5.77.1.aarch64_ilp32",
                  "product_id": "libcurl-devel-64bit-8.14.1-150400.5.77.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-64bit-8.14.1-150400.5.77.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl4-64bit-8.14.1-150400.5.77.1.aarch64_ilp32",
                  "product_id": "libcurl4-64bit-8.14.1-150400.5.77.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150400.5.77.1.i586",
                "product": {
                  "name": "curl-8.14.1-150400.5.77.1.i586",
                  "product_id": "curl-8.14.1-150400.5.77.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150400.5.77.1.i586",
                "product": {
                  "name": "libcurl-devel-8.14.1-150400.5.77.1.i586",
                  "product_id": "libcurl-devel-8.14.1-150400.5.77.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150400.5.77.1.i586",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150400.5.77.1.i586",
                  "product_id": "libcurl-mini4-8.14.1-150400.5.77.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150400.5.77.1.i586",
                "product": {
                  "name": "libcurl4-8.14.1-150400.5.77.1.i586",
                  "product_id": "libcurl4-8.14.1-150400.5.77.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-fish-completion-8.14.1-150400.5.77.1.noarch",
                "product": {
                  "name": "curl-fish-completion-8.14.1-150400.5.77.1.noarch",
                  "product_id": "curl-fish-completion-8.14.1-150400.5.77.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "curl-zsh-completion-8.14.1-150400.5.77.1.noarch",
                "product": {
                  "name": "curl-zsh-completion-8.14.1-150400.5.77.1.noarch",
                  "product_id": "curl-zsh-completion-8.14.1-150400.5.77.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-doc-8.14.1-150400.5.77.1.noarch",
                "product": {
                  "name": "libcurl-devel-doc-8.14.1-150400.5.77.1.noarch",
                  "product_id": "libcurl-devel-doc-8.14.1-150400.5.77.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150400.5.77.1.ppc64le",
                "product": {
                  "name": "curl-8.14.1-150400.5.77.1.ppc64le",
                  "product_id": "curl-8.14.1-150400.5.77.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150400.5.77.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-8.14.1-150400.5.77.1.ppc64le",
                  "product_id": "libcurl-devel-8.14.1-150400.5.77.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150400.5.77.1.ppc64le",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150400.5.77.1.ppc64le",
                  "product_id": "libcurl-mini4-8.14.1-150400.5.77.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150400.5.77.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.14.1-150400.5.77.1.ppc64le",
                  "product_id": "libcurl4-8.14.1-150400.5.77.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150400.5.77.1.s390x",
                "product": {
                  "name": "curl-8.14.1-150400.5.77.1.s390x",
                  "product_id": "curl-8.14.1-150400.5.77.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150400.5.77.1.s390x",
                "product": {
                  "name": "libcurl-devel-8.14.1-150400.5.77.1.s390x",
                  "product_id": "libcurl-devel-8.14.1-150400.5.77.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150400.5.77.1.s390x",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150400.5.77.1.s390x",
                  "product_id": "libcurl-mini4-8.14.1-150400.5.77.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150400.5.77.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-150400.5.77.1.s390x",
                  "product_id": "libcurl4-8.14.1-150400.5.77.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150400.5.77.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-150400.5.77.1.x86_64",
                  "product_id": "curl-8.14.1-150400.5.77.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150400.5.77.1.x86_64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150400.5.77.1.x86_64",
                  "product_id": "libcurl-devel-8.14.1-150400.5.77.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-32bit-8.14.1-150400.5.77.1.x86_64",
                "product": {
                  "name": "libcurl-devel-32bit-8.14.1-150400.5.77.1.x86_64",
                  "product_id": "libcurl-devel-32bit-8.14.1-150400.5.77.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150400.5.77.1.x86_64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150400.5.77.1.x86_64",
                  "product_id": "libcurl-mini4-8.14.1-150400.5.77.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150400.5.77.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-150400.5.77.1.x86_64",
                  "product_id": "libcurl4-8.14.1-150400.5.77.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-32bit-8.14.1-150400.5.77.1.x86_64",
                "product": {
                  "name": "libcurl4-32bit-8.14.1-150400.5.77.1.x86_64",
                  "product_id": "libcurl4-32bit-8.14.1-150400.5.77.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.3",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.3",
                  "product_id": "SUSE Linux Enterprise Micro 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.4",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.4",
                  "product_id": "SUSE Linux Enterprise Micro 5.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.5",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.5",
                  "product_id": "SUSE Linux Enterprise Micro 5.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150400.5.77.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64"
        },
        "product_reference": "curl-8.14.1-150400.5.77.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150400.5.77.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x"
        },
        "product_reference": "curl-8.14.1-150400.5.77.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150400.5.77.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64"
        },
        "product_reference": "curl-8.14.1-150400.5.77.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150400.5.77.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-150400.5.77.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150400.5.77.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-150400.5.77.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150400.5.77.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-150400.5.77.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150400.5.77.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64"
        },
        "product_reference": "curl-8.14.1-150400.5.77.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150400.5.77.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x"
        },
        "product_reference": "curl-8.14.1-150400.5.77.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150400.5.77.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64"
        },
        "product_reference": "curl-8.14.1-150400.5.77.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150400.5.77.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-150400.5.77.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150400.5.77.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-150400.5.77.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150400.5.77.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-150400.5.77.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150400.5.77.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64"
        },
        "product_reference": "curl-8.14.1-150400.5.77.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150400.5.77.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le"
        },
        "product_reference": "curl-8.14.1-150400.5.77.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150400.5.77.1.s390x as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x"
        },
        "product_reference": "curl-8.14.1-150400.5.77.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150400.5.77.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64"
        },
        "product_reference": "curl-8.14.1-150400.5.77.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150400.5.77.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-150400.5.77.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150400.5.77.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le"
        },
        "product_reference": "libcurl4-8.14.1-150400.5.77.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150400.5.77.1.s390x as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-150400.5.77.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150400.5.77.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-150400.5.77.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14017",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14017"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14017",
          "url": "https://www.suse.com/security/cve/CVE-2025-14017"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256105 for CVE-2025-14017",
          "url": "https://bugzilla.suse.com/1256105"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-13T14:50:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14017"
    },
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-13T14:50:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing TLS related transfers with reused easy or multi handles and\naltering the  `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-13T14:50:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-13T14:50:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-13T14:50:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

SUSE-SU-2026:20042-1

Vulnerability from csaf_suse - Published: 2026-01-08 15:18 - Updated: 2026-01-08 15:18

Summary

Security update for curl

Severity

Moderate

Notes

Title of the patch: Security update for curl

Patchnames: SUSE-SLE-Micro-6.0-546

CVE-2025-14524

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14819

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15079

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15224

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

20 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1255731	self
https://bugzilla.suse.com/1255732	self
https://bugzilla.suse.com/1255733	self
https://bugzilla.suse.com/1255734	self
https://www.suse.com/security/cve/CVE-2025-14524/	self
https://www.suse.com/security/cve/CVE-2025-14819/	self
https://www.suse.com/security/cve/CVE-2025-15079/	self
https://www.suse.com/security/cve/CVE-2025-15224/	self
https://www.suse.com/security/cve/CVE-2025-14524	external
https://bugzilla.suse.com/1255731	external
https://www.suse.com/security/cve/CVE-2025-14819	external
https://bugzilla.suse.com/1255732	external
https://www.suse.com/security/cve/CVE-2025-15079	external
https://bugzilla.suse.com/1255733	external
https://www.suse.com/security/cve/CVE-2025-15224	external
https://bugzilla.suse.com/1255734	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-546",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20042-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20042-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620042-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20042-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023765.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-08T15:18:54Z",
      "generator": {
        "date": "2026-01-08T15:18:54Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20042-1",
      "initial_release_date": "2026-01-08T15:18:54Z",
      "revision_history": [
        {
          "date": "2026-01-08T15:18:54Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-3.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-3.1.aarch64",
                  "product_id": "curl-8.14.1-3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-3.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-3.1.aarch64",
                  "product_id": "libcurl4-8.14.1-3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-3.1.s390x",
                "product": {
                  "name": "curl-8.14.1-3.1.s390x",
                  "product_id": "curl-8.14.1-3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-3.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-3.1.s390x",
                  "product_id": "libcurl4-8.14.1-3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-3.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-3.1.x86_64",
                  "product_id": "curl-8.14.1-3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-3.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-3.1.x86_64",
                  "product_id": "libcurl4-8.14.1-3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-3.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64"
        },
        "product_reference": "curl-8.14.1-3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-3.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x"
        },
        "product_reference": "curl-8.14.1-3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-3.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64"
        },
        "product_reference": "curl-8.14.1-3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-3.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-3.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-3.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T15:18:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing TLS related transfers with reused easy or multi handles and\naltering the  `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T15:18:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T15:18:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
          "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
          "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
            "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T15:18:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

SUSE-SU-2026:20062-1

Vulnerability from csaf_suse - Published: 2026-01-08 14:51 - Updated: 2026-01-08 14:51

Summary

Security update for curl

Severity

Moderate

Notes

Title of the patch: Security update for curl

Patchnames: SUSE-SLE-Micro-6.1-368

CVE-2025-14524

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14819

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15079

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15224

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

20 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1255731	self
https://bugzilla.suse.com/1255732	self
https://bugzilla.suse.com/1255733	self
https://bugzilla.suse.com/1255734	self
https://www.suse.com/security/cve/CVE-2025-14524/	self
https://www.suse.com/security/cve/CVE-2025-14819/	self
https://www.suse.com/security/cve/CVE-2025-15079/	self
https://www.suse.com/security/cve/CVE-2025-15224/	self
https://www.suse.com/security/cve/CVE-2025-14524	external
https://bugzilla.suse.com/1255731	external
https://www.suse.com/security/cve/CVE-2025-14819	external
https://bugzilla.suse.com/1255732	external
https://www.suse.com/security/cve/CVE-2025-15079	external
https://bugzilla.suse.com/1255733	external
https://www.suse.com/security/cve/CVE-2025-15224	external
https://bugzilla.suse.com/1255734	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-368",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20062-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20062-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620062-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20062-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023749.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-08T14:51:21Z",
      "generator": {
        "date": "2026-01-08T14:51:21Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20062-1",
      "initial_release_date": "2026-01-08T14:51:21Z",
      "revision_history": [
        {
          "date": "2026-01-08T14:51:21Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-slfo.1.1_4.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-slfo.1.1_4.1.aarch64",
                  "product_id": "curl-8.14.1-slfo.1.1_4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
                  "product_id": "libcurl4-8.14.1-slfo.1.1_4.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-slfo.1.1_4.1.ppc64le",
                "product": {
                  "name": "curl-8.14.1-slfo.1.1_4.1.ppc64le",
                  "product_id": "curl-8.14.1-slfo.1.1_4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
                  "product_id": "libcurl4-8.14.1-slfo.1.1_4.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-slfo.1.1_4.1.s390x",
                "product": {
                  "name": "curl-8.14.1-slfo.1.1_4.1.s390x",
                  "product_id": "curl-8.14.1-slfo.1.1_4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-slfo.1.1_4.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-slfo.1.1_4.1.s390x",
                  "product_id": "libcurl4-8.14.1-slfo.1.1_4.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-slfo.1.1_4.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-slfo.1.1_4.1.x86_64",
                  "product_id": "curl-8.14.1-slfo.1.1_4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-slfo.1.1_4.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-slfo.1.1_4.1.x86_64",
                  "product_id": "libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-slfo.1.1_4.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64"
        },
        "product_reference": "curl-8.14.1-slfo.1.1_4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-slfo.1.1_4.1.ppc64le as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le"
        },
        "product_reference": "curl-8.14.1-slfo.1.1_4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-slfo.1.1_4.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x"
        },
        "product_reference": "curl-8.14.1-slfo.1.1_4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-slfo.1.1_4.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64"
        },
        "product_reference": "curl-8.14.1-slfo.1.1_4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-slfo.1.1_4.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-slfo.1.1_4.1.ppc64le as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le"
        },
        "product_reference": "libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-slfo.1.1_4.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-slfo.1.1_4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-slfo.1.1_4.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-slfo.1.1_4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T14:51:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing TLS related transfers with reused easy or multi handles and\naltering the  `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T14:51:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T14:51:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
          "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
          "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
            "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T14:51:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

SUSE-SU-2026:20082-1

Vulnerability from csaf_suse - Published: 2026-01-14 10:58 - Updated: 2026-01-14 10:58

Summary

Security update for curl

Severity

Moderate

Notes

Title of the patch: Security update for curl

Description of the patch: This update for curl fixes the following issues: This update for curl fixes the following issues: - CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105). - CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731). - CVE-2025-14819: libssh global knownhost override (bsc#1255732). - CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733). - CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

Patchnames: SUSE-SLES-16.0-140

CVE-2025-14017

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

Recommended 36 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14524

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 36 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14819

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 36 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15079

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 36 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15224

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 36 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

24 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1255731	self
https://bugzilla.suse.com/1255732	self
https://bugzilla.suse.com/1255733	self
https://bugzilla.suse.com/1255734	self
https://bugzilla.suse.com/1256105	self
https://www.suse.com/security/cve/CVE-2025-14017/	self
https://www.suse.com/security/cve/CVE-2025-14524/	self
https://www.suse.com/security/cve/CVE-2025-14819/	self
https://www.suse.com/security/cve/CVE-2025-15079/	self
https://www.suse.com/security/cve/CVE-2025-15224/	self
https://www.suse.com/security/cve/CVE-2025-14017	external
https://bugzilla.suse.com/1256105	external
https://www.suse.com/security/cve/CVE-2025-14524	external
https://bugzilla.suse.com/1255731	external
https://www.suse.com/security/cve/CVE-2025-14819	external
https://bugzilla.suse.com/1255732	external
https://www.suse.com/security/cve/CVE-2025-15079	external
https://bugzilla.suse.com/1255733	external
https://www.suse.com/security/cve/CVE-2025-15224	external
https://bugzilla.suse.com/1255734	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\nThis update for curl fixes the following issues:\n\n- CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-140",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20082-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20082-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620082-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20082-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023816.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256105",
        "url": "https://bugzilla.suse.com/1256105"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14017 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14017/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-14T10:58:55Z",
      "generator": {
        "date": "2026-01-14T10:58:55Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20082-1",
      "initial_release_date": "2026-01-14T10:58:55Z",
      "revision_history": [
        {
          "date": "2026-01-14T10:58:55Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.aarch64",
                  "product_id": "curl-8.14.1-160000.4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-160000.4.1.aarch64",
                "product": {
                  "name": "libcurl-devel-8.14.1-160000.4.1.aarch64",
                  "product_id": "libcurl-devel-8.14.1-160000.4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-160000.4.1.aarch64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-160000.4.1.aarch64",
                  "product_id": "libcurl-mini4-8.14.1-160000.4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.aarch64",
                  "product_id": "libcurl4-8.14.1-160000.4.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
                "product": {
                  "name": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
                  "product_id": "curl-zsh-completion-8.14.1-160000.4.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
                "product": {
                  "name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
                  "product_id": "libcurl-devel-doc-8.14.1-160000.4.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.ppc64le",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.ppc64le",
                  "product_id": "curl-8.14.1-160000.4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
                  "product_id": "libcurl-devel-8.14.1-160000.4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-160000.4.1.ppc64le",
                "product": {
                  "name": "libcurl-mini4-8.14.1-160000.4.1.ppc64le",
                  "product_id": "libcurl-mini4-8.14.1-160000.4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.ppc64le",
                  "product_id": "libcurl4-8.14.1-160000.4.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.s390x",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.s390x",
                  "product_id": "curl-8.14.1-160000.4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-160000.4.1.s390x",
                "product": {
                  "name": "libcurl-devel-8.14.1-160000.4.1.s390x",
                  "product_id": "libcurl-devel-8.14.1-160000.4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-160000.4.1.s390x",
                "product": {
                  "name": "libcurl-mini4-8.14.1-160000.4.1.s390x",
                  "product_id": "libcurl-mini4-8.14.1-160000.4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.s390x",
                  "product_id": "libcurl4-8.14.1-160000.4.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.x86_64",
                  "product_id": "curl-8.14.1-160000.4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-160000.4.1.x86_64",
                "product": {
                  "name": "libcurl-devel-8.14.1-160000.4.1.x86_64",
                  "product_id": "libcurl-devel-8.14.1-160000.4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-160000.4.1.x86_64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-160000.4.1.x86_64",
                  "product_id": "libcurl-mini4-8.14.1-160000.4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.x86_64",
                  "product_id": "libcurl4-8.14.1-160000.4.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "curl-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "curl-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "curl-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "curl-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-zsh-completion-8.14.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch"
        },
        "product_reference": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch"
        },
        "product_reference": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-mini4-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "libcurl-mini4-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-mini4-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "libcurl-mini4-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-mini4-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "libcurl-mini4-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-mini4-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "libcurl-mini4-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "curl-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "curl-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "curl-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "curl-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-zsh-completion-8.14.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch"
        },
        "product_reference": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch"
        },
        "product_reference": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-mini4-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "libcurl-mini4-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-mini4-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "libcurl-mini4-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-mini4-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "libcurl-mini4-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-mini4-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "libcurl-mini4-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14017",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14017"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14017",
          "url": "https://www.suse.com/security/cve/CVE-2025-14017"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256105 for CVE-2025-14017",
          "url": "https://bugzilla.suse.com/1256105"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T10:58:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14017"
    },
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T10:58:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing TLS related transfers with reused easy or multi handles and\naltering the  `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T10:58:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T10:58:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T10:58:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

SUSE-SU-2026:20110-1

Vulnerability from csaf_suse - Published: 2026-01-14 10:58 - Updated: 2026-01-14 10:58

Summary

Security update for curl

Severity

Moderate

Notes

Title of the patch: Security update for curl

Patchnames: SUSE-SL-Micro-6.2-140

CVE-2025-14017

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14524

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14819

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15079

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-15224

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

24 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1255731	self
https://bugzilla.suse.com/1255732	self
https://bugzilla.suse.com/1255733	self
https://bugzilla.suse.com/1255734	self
https://bugzilla.suse.com/1256105	self
https://www.suse.com/security/cve/CVE-2025-14017/	self
https://www.suse.com/security/cve/CVE-2025-14524/	self
https://www.suse.com/security/cve/CVE-2025-14819/	self
https://www.suse.com/security/cve/CVE-2025-15079/	self
https://www.suse.com/security/cve/CVE-2025-15224/	self
https://www.suse.com/security/cve/CVE-2025-14017	external
https://bugzilla.suse.com/1256105	external
https://www.suse.com/security/cve/CVE-2025-14524	external
https://bugzilla.suse.com/1255731	external
https://www.suse.com/security/cve/CVE-2025-14819	external
https://bugzilla.suse.com/1255732	external
https://www.suse.com/security/cve/CVE-2025-15079	external
https://bugzilla.suse.com/1255733	external
https://www.suse.com/security/cve/CVE-2025-15224	external
https://bugzilla.suse.com/1255734	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\nThis update for curl fixes the following issues:\n\n- CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SL-Micro-6.2-140",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20110-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20110-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620110-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20110-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023878.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256105",
        "url": "https://bugzilla.suse.com/1256105"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14017 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14017/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-14T10:58:55Z",
      "generator": {
        "date": "2026-01-14T10:58:55Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20110-1",
      "initial_release_date": "2026-01-14T10:58:55Z",
      "revision_history": [
        {
          "date": "2026-01-14T10:58:55Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.aarch64",
                  "product_id": "curl-8.14.1-160000.4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.aarch64",
                  "product_id": "libcurl4-8.14.1-160000.4.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.ppc64le",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.ppc64le",
                  "product_id": "curl-8.14.1-160000.4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.ppc64le",
                  "product_id": "libcurl4-8.14.1-160000.4.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.s390x",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.s390x",
                  "product_id": "curl-8.14.1-160000.4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.s390x",
                  "product_id": "libcurl4-8.14.1-160000.4.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.x86_64",
                  "product_id": "curl-8.14.1-160000.4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.x86_64",
                  "product_id": "libcurl4-8.14.1-160000.4.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.2",
                "product": {
                  "name": "SUSE Linux Micro 6.2",
                  "product_id": "SUSE Linux Micro 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:transactional"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "curl-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "curl-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "curl-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "curl-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14017",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14017"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14017",
          "url": "https://www.suse.com/security/cve/CVE-2025-14017"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256105 for CVE-2025-14017",
          "url": "https://bugzilla.suse.com/1256105"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T10:58:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14017"
    },
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T10:58:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing TLS related transfers with reused easy or multi handles and\naltering the  `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T10:58:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T10:58:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
          "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
          "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
            "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T10:58:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

WID-SEC-W-2026-0030

Vulnerability from csaf_certbund - Published: 2026-01-06 23:00 - Updated: 2026-03-03 23:00

Summary

cURL: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: cURL ist eine Client-Software, die das Austauschen von Dateien mittels mehrerer Protokolle wie z. B. HTTP oder FTP erlaubt.

Angriff: Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme: - Sonstiges - UNIX

CVE-2025-13034

Affected products

Known affected 9 products

Product	Identifier	Version
Open Source cURL <8.18.0 Open Source / cURL		<8.18.0
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Meinberg LANTIME <7.10.008 Meinberg / LANTIME		<7.10.008
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Tenable Security Nessus Network Monitor <6.5.3 Tenable Security / Nessus Network Monitor		<6.5.3
NetApp Data ONTAP 9 NetApp / Data ONTAP	`cpe:/a:netapp:data_ontap:9`	9
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—

CVE-2025-14017

Affected products

Known affected 9 products

Product	Identifier	Version
Open Source cURL <8.18.0 Open Source / cURL		<8.18.0
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Meinberg LANTIME <7.10.008 Meinberg / LANTIME		<7.10.008
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Tenable Security Nessus Network Monitor <6.5.3 Tenable Security / Nessus Network Monitor		<6.5.3
NetApp Data ONTAP 9 NetApp / Data ONTAP	`cpe:/a:netapp:data_ontap:9`	9
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—

CVE-2025-14524

Affected products

Known affected 9 products

Product	Identifier	Version
Open Source cURL <8.18.0 Open Source / cURL		<8.18.0
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Meinberg LANTIME <7.10.008 Meinberg / LANTIME		<7.10.008
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Tenable Security Nessus Network Monitor <6.5.3 Tenable Security / Nessus Network Monitor		<6.5.3
NetApp Data ONTAP 9 NetApp / Data ONTAP	`cpe:/a:netapp:data_ontap:9`	9
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—

CVE-2025-14819

Affected products

Known affected 9 products

Product	Identifier	Version
Open Source cURL <8.18.0 Open Source / cURL		<8.18.0
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Meinberg LANTIME <7.10.008 Meinberg / LANTIME		<7.10.008
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Tenable Security Nessus Network Monitor <6.5.3 Tenable Security / Nessus Network Monitor		<6.5.3
NetApp Data ONTAP 9 NetApp / Data ONTAP	`cpe:/a:netapp:data_ontap:9`	9
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—

CVE-2025-15079

Affected products

Known affected 9 products

Product	Identifier	Version
Open Source cURL <8.18.0 Open Source / cURL		<8.18.0
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Meinberg LANTIME <7.10.008 Meinberg / LANTIME		<7.10.008
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Tenable Security Nessus Network Monitor <6.5.3 Tenable Security / Nessus Network Monitor		<6.5.3
NetApp Data ONTAP 9 NetApp / Data ONTAP	`cpe:/a:netapp:data_ontap:9`	9
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—

CVE-2025-15224

Affected products

Known affected 9 products

Product	Identifier	Version
Open Source cURL <8.18.0 Open Source / cURL		<8.18.0
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Meinberg LANTIME <7.10.008 Meinberg / LANTIME		<7.10.008
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Tenable Security Nessus Network Monitor <6.5.3 Tenable Security / Nessus Network Monitor		<6.5.3
NetApp Data ONTAP 9 NetApp / Data ONTAP	`cpe:/a:netapp:data_ontap:9`	9
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—

References

33 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://curl.se/docs/CVE-2025-15224.html	external
https://curl.se/docs/CVE-2025-15079.html	external
https://curl.se/docs/CVE-2025-14819.html	external
https://curl.se/docs/CVE-2025-14524.html	external
https://curl.se/docs/CVE-2025-14017.html	external
https://curl.se/docs/CVE-2025-13034.html	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.opensuse.org/archives/list/security…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://de.tenable.com/security/tns-2026-02	external
http://news.meinberg.de/664/	external
https://security.netapp.com/advisory/NTAP-20260213-0015	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://alas.aws.amazon.com/AL2/ALAS2-2026-3173.html	external
https://ubuntu.com/security/notices/USN-8062-1	external
https://ubuntu.com/security/notices/USN-8062-2	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "cURL ist eine Client-Software, die das Austauschen von Dateien mittels mehrerer Protokolle wie z. B. HTTP oder FTP erlaubt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0030 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0030.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0030 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0030"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-15224.html"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-15079.html"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-14819.html"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-14524.html"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-14017.html"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-13034.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0050-1 vom 2026-01-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023698.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0052-1 vom 2026-01-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023696.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0051-1 vom 2026-01-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023697.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0066-1 vom 2026-01-08",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023711.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0077-1 vom 2026-01-09",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CCUZ47ZAPZKRFVFRPWIPP3KM2XGIRDMB/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0078-1 vom 2026-01-09",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023713.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:10017-1 vom 2026-01-09",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KOOXMCTVUTDBJAD5HQRMQVZJRZJF2ZXZ/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0119-1 vom 2026-01-13",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023738.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:20062-1 vom 2026-01-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023749.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:20042-1 vom 2026-01-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023765.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:20031-1 vom 2026-01-15",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FSLWWKBPXO4RTMMBYCCKFIGY2YFQPHSX/"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-E27B23AF78 vom 2026-01-20",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-e27b23af78"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-3F0F0F85BE vom 2026-01-20",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3f0f0f85be"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:20082-1 vom 2026-01-20",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023816.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0221-1 vom 2026-01-22",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023864.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:20110-1 vom 2026-01-23",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023878.html"
      },
      {
        "category": "external",
        "summary": "Tenable Security Advisory TNS-2026-02 vom 2026-01-27",
        "url": "https://de.tenable.com/security/tns-2026-02"
      },
      {
        "category": "external",
        "summary": "Meinberg Security Advisory MBGSA-2026.02 vom 2026-02-10",
        "url": "http://news.meinberg.de/664/"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20260213-0015 vom 2026-02-13",
        "url": "https://security.netapp.com/advisory/NTAP-20260213-0015"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0508-1 vom 2026-02-13",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024240.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:20347-1 vom 2026-02-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024282.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:20358-1 vom 2026-02-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024325.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2026-3173 vom 2026-02-19",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2-2026-3173.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-8062-1 vom 2026-02-25",
        "url": "https://ubuntu.com/security/notices/USN-8062-1"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-8062-2 vom 2026-03-03",
        "url": "https://ubuntu.com/security/notices/USN-8062-2"
      }
    ],
    "source_lang": "en-US",
    "title": "cURL: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-03-03T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-04T11:18:13.983+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0030",
      "initial_release_date": "2026-01-06T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-01-06T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-01-07T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-01-08T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von SUSE und European Union Vulnerability Database aufgenommen"
        },
        {
          "date": "2026-01-11T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE und openSUSE aufgenommen"
        },
        {
          "date": "2026-01-13T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-01-14T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-01-15T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von openSUSE aufgenommen"
        },
        {
          "date": "2026-01-19T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Fedora aufgenommen"
        },
        {
          "date": "2026-01-20T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-01-22T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-01-27T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Tenable aufgenommen"
        },
        {
          "date": "2026-02-10T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Meinberg aufgenommen"
        },
        {
          "date": "2026-02-12T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2026-02-15T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-02-16T23:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-02-17T23:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-02-18T23:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2026-02-24T23:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2026-03-03T23:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        }
      ],
      "status": "final",
      "version": "19"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.10.008",
                "product": {
                  "name": "Meinberg LANTIME \u003c7.10.008",
                  "product_id": "T050722"
                }
              },
              {
                "category": "product_version",
                "name": "7.10.008",
                "product": {
                  "name": "Meinberg LANTIME 7.10.008",
                  "product_id": "T050722-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:meinberg:lantime:7.10.008"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LANTIME"
          }
        ],
        "category": "vendor",
        "name": "Meinberg"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9",
                "product": {
                  "name": "NetApp Data ONTAP 9",
                  "product_id": "T039981",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:data_ontap:9"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Data ONTAP"
          }
        ],
        "category": "vendor",
        "name": "NetApp"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8.18.0",
                "product": {
                  "name": "Open Source cURL \u003c8.18.0",
                  "product_id": "T049738"
                }
              },
              {
                "category": "product_version",
                "name": "8.18.0",
                "product": {
                  "name": "Open Source cURL 8.18.0",
                  "product_id": "T049738-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:curl:curl:8.18.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "cURL"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T027843",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.5.3",
                "product": {
                  "name": "Tenable Security Nessus Network Monitor \u003c6.5.3",
                  "product_id": "T050330"
                }
              },
              {
                "category": "product_version",
                "name": "6.5.3",
                "product": {
                  "name": "Tenable Security Nessus Network Monitor 6.5.3",
                  "product_id": "T050330-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:tenable:nessus_network_monitor:6.5.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Nessus Network Monitor"
          }
        ],
        "category": "vendor",
        "name": "Tenable Security"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-13034",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207",
          "T050722",
          "T000126",
          "T027843",
          "398363",
          "T050330",
          "T039981",
          "74185"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-13034"
    },
    {
      "cve": "CVE-2025-14017",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207",
          "T050722",
          "T000126",
          "T027843",
          "398363",
          "T050330",
          "T039981",
          "74185"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-14017"
    },
    {
      "cve": "CVE-2025-14524",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207",
          "T050722",
          "T000126",
          "T027843",
          "398363",
          "T050330",
          "T039981",
          "74185"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207",
          "T050722",
          "T000126",
          "T027843",
          "398363",
          "T050330",
          "T039981",
          "74185"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207",
          "T050722",
          "T000126",
          "T027843",
          "398363",
          "T050330",
          "T039981",
          "74185"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207",
          "T050722",
          "T000126",
          "T027843",
          "398363",
          "T050330",
          "T039981",
          "74185"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-15224"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-14524 (GCVE-0-2025-14524)

Tags

Sightings

Nomenclature