Files
Bernd Kuhls 3a5e071e4f package/libcurl: security bump to version 8.19.0
https://curl.se/ch/8.19.0.html
https://curl.se/docs/security.html

Fixes the following CVEs:

CVE-2026-3805: use after free in SMB connection reuse
CVE-2026-3784: wrong proxy connection reuse with credentials
CVE-2026-3783: token leak with redirect and netrc
CVE-2026-1965: bad reuse of HTTP Negotiate connection

Switch to sha256 tarball hash provided by upstream.

Updated license hash due to copyright year bump:
https://github.com/curl/curl/commit/e83c82f05f9b714086e62db9fe2ea9be522239bc

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add back pgp signature info in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-12 21:02:06 +01:00

8 lines
396 B
Plaintext

# From https://github.com/curl/curl/releases/tag/curl-8_19_0
# after checking pgp signature:
# https://curl.se/download/curl-8.19.0.tar.xz.asc
# signed with key 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2
sha256 4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d333f11df curl-8.19.0.tar.xz
# Locally computed
sha256 82f2f4427d6545ee5aaac4f0b80428da6cc8ba41c2cf5da3a03680ec327b9681 COPYING