Vulnerability CVE-2023-23914: Information

Description

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.

Severity: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-23914
Published: Feb. 23, 2023
Modified: March 27, 2024
Error type identifier: CWE-319

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
curlsisyphus7.88.0-alt18.7.1-alt2ALT-PU-2023-1252-1315265Fixed
curlsisyphus_e2k7.88.0-alt18.7.1-alt2ALT-PU-2023-2585-1-Fixed
curlsisyphus_riscv647.88.0-alt18.7.1-alt2ALT-PU-2023-2570-1-Fixed
curlp107.88.0-alt18.7.1-alt2ALT-PU-2023-1292-1315266Fixed
curlp10_e2k7.88.0-alt18.7.1-alt2ALT-PU-2023-2647-1-Fixed
curlc10f17.88.0-alt18.6.0-alt1ALT-PU-2023-1292-1315266Fixed
curlc9f28.3.0-alt18.6.0-alt1ALT-PU-2023-5727-4329877Fixed
curlp117.88.0-alt18.7.1-alt2ALT-PU-2023-1252-1315265Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://hackerone.com/reports/1813864
  • Exploit
  • Issue Tracking
https://security.netapp.com/advisory/ntap-20230309-0006/
  • Third Party Advisory
GLSA-202310-12
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
      Start including
      7.77.0
      End excliding
      7.88.0

      Configuration 2

      cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
      cpe:2.3:a:netapp:clustered_data_ontap:9.0:-:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

      Configuration 5

      cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

      Configuration 6

      cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

      Configuration 7

      cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
      cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
      Start including
      9.0.0
      End excliding
      9.0.6
      cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
      Start including
      8.2.0
      End excliding
      8.2.12
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top