CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-0853 – OCSP verification bypass with TLS session reuse
https://notcve.org/view.php?id=CVE-2024-0853
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check. curl inadvertidamente mantuvo el ID de sesión SSL para las conexiones en su caché incluso cuando falló la prueba de verificación del estado (*OCSP stapling*). Una transferencia posterior al mismo nombre de host podría tener éxito si la caché de ID de sesión aún estuviera actualizada, lo que luego omitiría la verificación de estado de verificación. • https://curl.se/docs/CVE-2024-0853.html https://curl.se/docs/CVE-2024-0853.json https://hackerone.com/reports/2298922 https://security.netapp.com/advisory/ntap-20240307-0004 https://security.netapp.com/advisory/ntap-20240426-0009 https://security.netapp.com/advisory/ntap-20240503-0012 • CWE-295: Improper Certificate Validation •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2023-46219 – curl: excessively long file name may lead to unknown HSTS status
https://notcve.org/view.php?id=CVE-2023-46219
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. Al guardar datos HSTS en un nombre de archivo excesivamente largo, curl podría terminar eliminando todo el contenido, haciendo que las solicitudes posteriores que utilicen ese archivo desconozcan el estado HSTS que de otro modo deberían usar. A security bypass flaw was found in Curl, which can be triggered by saving HSTS data to an excessively long file name. This issue occurs due to an error in handling HSTS long file names, leading to the removal of all contents from the file during the save process, and may allow a remote attacker to send a specially crafted request to use files without awareness of the HSTS status and enable a Man-in-the-Middle (MitM) attack. • https://curl.se/docs/CVE-2023-46219.html https://hackerone.com/reports/2236133 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD https://security.netapp.com/advisory/ntap-20240119-0007 https://www.debian.org/security/2023/dsa-5587 https://access.redhat.com/security/cve/CVE-2023-46219 https://bugzilla.redhat.com/show_bug.cgi?id=2252034 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-46218 – curl: information disclosure by exploiting a mixed case flaw
https://notcve.org/view.php?id=CVE-2023-46218
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain. Esta falla permite que un servidor HTTP malicioso establezca "supercookies" en curl que luego se devuelven a más orígenes de los que están permitidos o son posibles. Esto permite que un sitio establezca cookies que luego se enviarán a sitios y dominios diferentes y no relacionados. • https://curl.se/docs/CVE-2023-46218.html https://hackerone.com/reports/2212193 https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD https://security.netapp.com/advisory/ntap-20240125-0007 https://www.debian.org/security/2023/dsa-5587 https://access.redhat • CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 8CVE-2023-38545 – curl: heap based buffer overflow in the SOCKS5 proxy handshake
https://notcve.org/view.php?id=CVE-2023-38545
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. Esta falla hace que curl desborde un búfer basado en el protocolo de enlace del proxy SOCKS5. Cuando se le pide a curl que pase el nombre de host al proxy SOCKS5 para permitir que resuelva la dirección en lugar de que lo haga curl mismo, la longitud máxima que puede tener el nombre de host es 255 bytes. Si se detecta que el nombre de host es más largo, curl cambia a la resolución de nombres local y en su lugar pasa solo la dirección resuelta. • https://github.com/d0rb/CVE-2023-38545 https://github.com/vanigori/CVE-2023-38545-sample https://github.com/UTsweetyfish/CVE-2023-38545 https://github.com/fatmo666/CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflow https://github.com/imfht/CVE-2023-38545 https://github.com/bcdannyboy/CVE-2023-38545 https://github.com/dbrugman/CVE-2023-38545-POC https://github.com/Yang-Shun-Yu/CVE-2023-38545 http://seclists.org/fulldisclosure/2024/Jan/34 http://seclists.org/fulldisclosure • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 3.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-38546 – curl: cookie injection with none file
https://notcve.org/view.php?id=CVE-2023-38546
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course. Esta falla permite a un atacante insertar cookies a voluntad en un programa en ejecución usando libcurl, si se cumple una serie específica de condiciones. libcurl realiza transferencias. • http://seclists.org/fulldisclosure/2024/Jan/34 http://seclists.org/fulldisclosure/2024/Jan/37 http://seclists.org/fulldisclosure/2024/Jan/38 https://curl.se/docs/CVE-2023-38546.html https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ https://support.apple.com/kb/HT214036 https://support.apple.com/kb/HT214057 https://support.apple.com/kb/HT214058 https://sup • CWE-73: External Control of File Name or Path •