Vulnerability CVE-2025-15224: Information
Description
When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.
Severity: LOW (3.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| curl | sisyphus | 8.18.0-alt1 | 8.18.0-alt1 | ALT-PU-2026-1133-1 | 404633 | Fixed |
| curl | sisyphus_riscv64 | 8.18.0-alt1 | 8.18.0-alt1 | ALT-PU-2026-1147-1 | - | Fixed |
| curl | sisyphus_loongarch64 | 8.18.0-alt1 | 8.18.0-alt1 | ALT-PU-2026-1153-1 | - | Fixed |
| curl | p11 | 8.18.0-alt1 | 8.14.1-alt2 | ALT-PU-2026-1135-1 | 404638 | Testing |