Ubuntu USN-8487-2 Corrects the curl CVE-2026-8927 Fix
Tech GuruQuick Answer
USN-8487-2 corrects an incomplete CVE-2026-8927 fix for Ubuntu 14.04 LTS with Legacy Support. Reusing a transfer handle with environment-configured proxies could leave proxy-authentication information from an earlier request in place and disclose credentials. The corrected package build is 7.35.0-1ubuntu2.20+esm23.
Confirm Scope And Apply The Supported Fix
What to do now: update the installed binaries listed in the USN, not just the curl command-line program. Canonical lists curl, libcurl3, libcurl3-gnutls, libcurl3-nss, libcurl4-gnutls-dev, libcurl4-nss-dev and libcurl4-openssl-dev at the corrected version. Update those present; this is not an instruction to install every variant.
Last verified: October 2, 2026 UTC against USN-8487-2. No package or proxy test was run.
Scope And Authority
| Product scope | Ubuntu 14.04 LTS (Trusty) curl packages covered by Legacy Support |
|---|---|
| Advisory | USN-8487-2 |
| CVE | CVE-2026-8927 |
| Authoritative release date | 2026-09-28 20:29:10.831741 UTC |
| Authority revision date | No separate material revision date stated by Canonical when verified |
| Affected versions | Ubuntu 14.04 LTS (Trusty) curl/libcurl binary packages covered by Legacy Support before 7.35.0-1ubuntu2.20+esm23. Other releases in the original USN are not automatically in this follow-up's scope. |
| Fixed version | 7.35.0-1ubuntu2.20+esm23 for the Trusty Legacy Support curl and libcurl binaries listed in USN-8487-2 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The earlier USN-8487-1 update was incomplete for this CVE. Installing that earlier build is not sufficient evidence of the correction. A libcurl-using service may remain relevant even when nobody invokes the curl command interactively.
What To Validate Now
- Match Trusty and entitlement. Confirm Ubuntu14.04 and access to the supported Legacy Support repository. Identify installed curl/libcurl variants and services using them.
- Apply the corrected binaries. Update applicable installed packages to the USN's build through the entitled repository. Separately assess private library copies or images not maintained by that package transaction.
- Replace loaded code. Restart affected long-running consumers through their maintenance procedure, then verify package versions and normal transfer behavior.
- Test proxy boundaries safely. Where proxy authentication is used, exercise authorized test endpoints with disposable test credentials. Check that requests use the intended proxy identity; do not capture production passwords in verbose traces or tickets.
- Retain scoped results. Record the actual binaries, repository and consumer tests. A passing transfer does not establish that earlier credentials were never exposed.
Operational Cautions
This is a regression follow-up for an incomplete prior fix, not evidence that every system named in the original advisory remains affected. Preserve repository entitlement and test applications that embed libcurl.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
