{"id":"CLSA-2026-1773161124","summary":"Fix CVE(s): CVE-2021-22876, CVE-2025-15079","details":"   * SECURITY UPDATE: acceptance of hosts not listed in specified known_hosts\n     file during SSH-based transfers\n     - debian/patches/CVE-2025-15079.patch: Set both knownhosts options to same\n       file and fix surprises caused by libssh exposing separate KNOWNHOSTS and\n       GLOBAL_KNOWNHOSTS options.\n     - CVE-2025-15079\n   * Regenerate Server-localhost-lastSAN-sv test certificate with SHA-256\n     - debian/patches/regenerate-lastSAN-cert-sha256.patch: Fix \"ca md too weak\"\n       error with OpenSSL 1.1.1+ by replacing SHA-1 signed certificate with\n       SHA-256. Also fixes Makefile.am bug for lastSAN target.\n   * Update failed test\n     - debian/patches/26_CVE-2021-22876.patch: Update test to avoid using\n       unsupported commands\n   * Update failed test\n     - debian/patches/fix-test323-errorcode.patch: two valid error codes now\n   * Disable some tests\n     - debian/rules: add option to disable tests marked as flaky, fail the\n       build if any test fails\n     - debian/patches/add-flaky-to-test1592.patch: mark test1592 as flaky\n     - debian/patches/disable-nss-failing-tests.patch: libnsspem.so is not\n       available on Debian 10\n   * Remove unsupported test:\n     - debian/patches/test8-verify-that-ctrl-byte-cookies-are-ignored.patch:\n       no ctrl-byte-cookies are supported","modified":"2026-06-04T09:45:17.524132702Z","published":"2026-03-10T16:45:29Z","upstream":["CVE-2021-22876","CVE-2025-15079"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1773161124.html"}],"affected":[{"package":{"name":"curl","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/curl?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1773161124.json"}},{"package":{"name":"libcurl3-gnutls","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl3-gnutls?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1773161124.json"}},{"package":{"name":"libcurl3-nss","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl3-nss?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1773161124.json"}},{"package":{"name":"libcurl4","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl4?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1773161124.json"}},{"package":{"name":"libcurl4-doc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl4-doc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1773161124.json"}},{"package":{"name":"libcurl4-gnutls-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl4-gnutls-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1773161124.json"}},{"package":{"name":"libcurl4-nss-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl4-nss-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1773161124.json"}},{"package":{"name":"libcurl4-openssl-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl4-openssl-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1773161124.json"}}],"schema_version":"1.7.5"}