CVE Request -- cURL/libCURL 7.20.0

[Jan Lieskovsky <jlieskov () redhat com>]

Hi Steve, vendors,

  cURL upstream has released latest v7.20.0 version of cURL/libCURL
fixing the "libcurl data callback excessive length" issue.

References:
[1] http://curl.haxx.se/docs/security.html#20100209
[2] http://curl.haxx.se/docs/adv_20100209.html
[3] http://curl.haxx.se/libcurl-contentencoding.patch
[4] http://curl.haxx.se/download.html

Mitigation factors (from [1]):

"This error is only present in zlib-enabled builds of libcurl and only if
 automatic decompression has been explicitly enabled by the application - it
 is disabled by default."

Could you allocate CVE id for this?

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team