QSN-8670-2: curl vulnerability
2026-08-25

Summary:
curl could be made to expose sensitive information.

Details:
USN-8670-1 fixed a vulnerability in curl. This update provides the
corresponding update for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
22.04 LTS.

Original advisory details:

 Joshua Rogers discovered that curl incorrectly handled reusing
 connections when client certificate settings changed. This could result
 in the wrong client certificates being used, contrary to expectations.

Affected QuantaStor releases:
  6.9.1.001 jammy: curl 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.27)
  6.9.1.001 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.27)
  6.9.1.001 jammy: libcurl4 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.27)
  6.9.0.464 jammy: curl 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.27)
  6.9.0.464 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.27)
  6.9.0.464 jammy: libcurl4 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.27)
  6.8.6.015 jammy: curl 7.81.0-1ubuntu1.27 (fixed in 7.81.0-1ubuntu1.27)
  6.8.6.015 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.27 (fixed in 7.81.0-1ubuntu1.27)
  6.8.6.015 jammy: libcurl4 7.81.0-1ubuntu1.27 (fixed in 7.81.0-1ubuntu1.27)
  6.8.5.018 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.5.018 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.5.018 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.4.038 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.4.038 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.4.038 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.3.018 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.3.018 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.3.018 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.2.002 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.2.002 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.2.002 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.1.007 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.1.007 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.1.007 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.0.205 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.0.205 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)
  6.8.0.205 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.27)

CVEs: CVE-2026-8932

References:
  https://ubuntu.com/security/notices/USN-8670-2