libcurl vulnerabilities

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.

When doing TLS transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a cached CA store for which the partial chain option was reversed. Contrary to user expectations, libcurl could find and accept a trust chain it otherwise would not.

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread inadvertently changed them globally and could affect other concurrently set up transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

libcurl built with mbedTLS did not check the server certificate for TLS connections to a host specified as an IP address. The set hostname function was wrongly skipped, completely bypassing certificate verification for HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc.

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite an SSH option being modified, which should have prevented reuse. Two SSH settings were omitted from the configuration check, allowing them to match easily and potentially leading to reuse of an inappropriate connection.

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

An authentication bypass vulnerability exists in libcurl before 8.0.0 in the connection reuse feature. Failure to check for changes in CURLOPT_GSSAPI_DELEGATION can reuse connections with incorrect user permissions, affecting krb5/kerberos/negotiate/GSSAPI transfers.

An authentication bypass vulnerability exists in libcurl before 8.0.0 in the FTP connection reuse feature. Certain FTP settings (CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, CURLOPT_USE_SSL) were not included in connection matching, potentially causing wrong credentials to be used.

libcurl has an issue with reusing previously created connections even when TLS or SSH-related options have been changed that should prohibit reuse. Several TLS and SSH settings were left out from the configuration match checks, making them match too easily.

libcurl provides the `CURLOPT_CERTINFO` option to allow applications to request details about a server's certificate chain. Due to an erroneous function, a malicious server could make libcurl built with NSS get stuck in a never-ending busy-loop when trying to retrieve that information.

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if the host name is provided with a trailing dot. The built-in rudimentary check fails in this case when Public Suffix List support is not available. As a result, arbitrary sites can set cookies that would then be sent to a different and unrelated site or domain.