UBUNTU-CVE-2025-15224

Details

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.

Affected Packages

curl

Ubuntu 22.04 LTS

Fixed in:

7.81.0-1ubuntu1.22

curl

Ubuntu 24.04 LTS

Fixed in:

8.5.0-2ubuntu10.7

curl

Ubuntu Pro 18.04 LTS

Fixed in:

7.58.0-2ubuntu3.24+esm7

curl

Ubuntu Pro 20.04 LTS

Fixed in:

7.68.0-1ubuntu2.25+esm2

References

REPORT

https://curl.se/docs/CVE-2025-15224.html

REPORT

https://ubuntu.com/security/CVE-2025-15224

ADVISORY

https://ubuntu.com/security/notices/USN-8062-1

ADVISORY

https://ubuntu.com/security/notices/USN-8062-2

REPORT

https://www.cve.org/CVERecord?id=CVE-2025-15224