| Package | Affected versions | Patched versions |
|---|---|---|
| curl | ≥ 7.20.0, < 7.79.0 | 7.79.0 |
| commerce guided search | = 11.3.2 | |
| communications cloud native core binding support function | = 1.11.0= 22.1.3 | |
| communications cloud native core console | = 22.2.0 | |
| communications cloud native core network function cloud native environment | = 1.10.0 | |
| communications cloud native core network repository function | = 1.15.0= 1.15.1= 22.1.0= 22.2.0 | |
| communications cloud native core network slice selection function | = 1.8.0 | |
| communications cloud native core security edge protection proxy | = 22.1.1 | |
| communications cloud native core service communication proxy | = 1.15.0 | |
| mysql server | ≥ 5.7.0, ≤ 5.7.35≥ 8.0.0, ≤ 8.0.26 | |
| peoplesoft enterprise peopletools | = 8.57= 8.58= 8.59 | |
| sinec infrastructure network services | < 1.0.1.1 | 1.0.1.1 |
| universal forwarder | = 9.1.0≥ 8.2.0, < 8.2.12≥ 9.0.0, < 9.0.6 | 8.2.129.0.6 |
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free