Bug 2413427

Summary:	CVE-2025-10966 curl: Curl missing SFTP host verification with wolfSSH backend [fedora-41]
Product:	[Fedora] Fedora	Reporter:	Jon Moroney <jmoroney>
Component:	curl	Assignee:	Jan Macku <jamacku>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	41	CC:	jamacku, jmigacz, kdudka, lzaoral, msekleta, paul, vmihalko
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["e0d240e5-91a9-49b2-9728-fde047232b97"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-11-08 12:16:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2413308

Description Jon Moroney 2025-11-07 19:10:19 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams

Comment 1 Paul Howarth 2025-11-08 12:16:04 UTC

curl in Fedora has never used the WolfSSH backend and is therefore not affected by this issue.