curl -- multiple vulnerabilities

Harry Sintonen and Patrick Monnerat report:

CVE-2023-23914

      A cleartext transmission of sensitive information
      vulnerability exists in curl < v7.88.0 that could
      cause HSTS functionality fail when multiple URLs are
      requested serially. Using its HSTS support, curl can be
      instructed to use HTTPS instead of using an insecure
      clear-text HTTP step even when HTTP is provided in the
      URL. This HSTS mechanism would however surprisingly be
      ignored by subsequent transfers when done on the same
      command line because the state would not be properly
      carried on.

CVE-2023-23915

      A cleartext transmission of sensitive information
      vulnerability exists in curl < v7.88.0 that could
      cause HSTS functionality to behave incorrectly when
      multiple URLs are requested in parallel. Using its HSTS
      support, curl can be instructed to use HTTPS instead of
      using an insecure clear-text HTTP step even when HTTP is
      provided in the URL. This HSTS mechanism would however
      surprisingly fail when multiple transfers are done in
      parallel as the HSTS cache file gets overwritten by the
      most recently completed transfer. A later HTTP-only
      transfer to the earlier host name would then *not* get
      upgraded properly to HSTS.

CVE-2023-23916

      An allocation of resources without limits or throttling
      vulnerability exists in curl < v7.88.0 based on the
      "chained" HTTP compression algorithms, meaning
      that a server response can be compressed multiple times
      and potentially with different algorithms. The number of
      acceptable "links" in this "decompression
      chain" was capped, but the cap was implemented on a
      per-header basis allowing a malicious server to insert a
      virtually unlimited number of compression steps simply
      by using many headers. The use of such a decompression
      chain could result in a "malloc bomb", making
      curl end up spending enormous amounts of allocated heap
      memory, or trying to and returning out of memory errors.