Importing a includeSubDomains parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
childs valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Hardened Images | RedHat | curl-main-8.23.0-0.1.hum1 | * |
| Curl | Ubuntu | devel | * |
| Curl | Ubuntu | jammy | * |
| Curl | Ubuntu | noble | * |
| Curl | Ubuntu | resolute | * |
| Curl | Ubuntu | stonking | * |
| Curl | Ubuntu | upstream | * |