The vulnerability of the HSTS (HTTP Strict Transport Security) mechanism in the cURL command line utility allows a perpetrator to gain unauthorized access to protected information.

🗓️ 20 Apr 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Curl HSTS flaw leaks plaintext via spoofed IDN names with similar ASCII symbols, enabling access.

Reporter	Title	Published	Views	Family All 264
IBM Security Bulletins	Security Bulletin: libcurl as used by IBM QRadar Wincollect agent is vulnerable to denial of service (CVE-2022-43552, CVE-2022-43551)	25 Jan 202319:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	15 Jun 202317:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Golang, Python, postgresql, cURL libcurl might affect IBM Spectrum Copy Data Management	28 Jul 202315:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, libcurl, Golang Go, Jetty, Guava, Netty, OpenSSL, Linux kernel may affect IBM Spectrum Protect Plus	23 Mar 202320:19	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple publicly disclosed Libcurl vulnerabilities affect IBM Safer Payments	16 May 202322:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in cURL libcurl affect AIX	29 Jun 202316:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Commons, Tomcat, Go, libcurl, OpenSSL, Python, Node.js, and Linux can affect IBM Spectrum Protect Plus.	20 Jun 202316:49	–	ibm
Tenable Nessus	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2023-276)	25 Jan 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-083)	21 Mar 202300:00	–	nessus

Vulners

Node

daniel_stenberg curlRange7.77.0–7.86.0

OR

project_harbor harborMatch2.7.0

OR

fedora fedoraMatch37

Source	Link
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-curl-cve-2022-43551/
access	www.access.redhat.com/security/cve/cve-2022-43551
hackerone	www.hackerone.com/reports/1755083
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVWZW5CNSJ7UYAF2BGSYAWAEXDJYUBHA/
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
curl	www.curl.se/docs/CVE-2022-43551.html
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.7/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
web	www.web.nvd.nist.gov/view/vuln/detail

13 Sep 2024 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 37.5

CVSS 27.8

EPSS0.17011

curl command line http strict transport internationalized domain names plaintext leakage symbol spoofing