An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However certain FTP settings such as CURLOPT_FTP_ACCOUNT CURLOPT_FTP_ALTERNATIVE_TO_USER CURLOPT_FTP_SSL_CCC and CURLOPT_USE_SSL were not included in the configuration match checks causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer potentially allowing unauthorized access to sensitive information.

🗓️ 01 Apr 2023 07:00:00Reported by MicrosoftType

Auth bypass in libcurl <8.0.0 via FTP reuse with mismatched settings could expose credentials.

Reporter	Title	Published	Views	Family All 217
IBM Security Bulletins	Security Bulletin: IBM MQ is affected by vulnerabilities in libcURL (CVE-2023-23916, CVE-2023-27535)	22 Jun 202317:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	15 Jun 202317:06	–	ibm
IBM Security Bulletins	Security Bulletin: cURL as used by IBM QRadar WinCollect Agent contains multiple vulnerabilities	8 Jun 202321:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by libcurl vulnerability	11 Oct 202311:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Progress DataDirect Connect for ODBC	26 Mar 202503:49	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL libcurl might affect IBM Spectrum Copy Data Management	15 Sep 202313:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple publicly disclosed Libcurl vulnerabilities affect IBM Safer Payments	16 May 202322:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from curl, go and apr-util	16 Jun 202304:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Improper Authentication in the RHEL UBI (CVE-2023-27535)	19 Jan 202422:05	–	ibm