Lucene search

K

SelmelcH1:2146691

HistorySep 13, 2023 - 2:52 p.m.

Internet Bug Bounty: [curl] CVE-2023-38039: HTTP header allocation DOS

2023-09-1314:52:07

selmelc

hackerone.com

$2540

54

internet bug bounty

cve-2023-38039

http header allocation

dos

curl

bugbounty

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

39.8%

Hello reporting for CVE-2023-38039 which has been fixed in the latest release of curl today.
Link to original report : #2072338

Thanks for your help, if there’s anything else you need from me I’ll happily share.
Have a nice day !

Impact

DOS/overloading of user’s system through malicious HTTP server interaction with curl’s header parsing.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

39.8%