Lucene search

K
nvd[email protected]NVD:CVE-2023-28322
HistoryMay 26, 2023 - 9:15 p.m.

CVE-2023-28322

2023-05-2621:15:16
CWE-200
web.nvd.nist.gov
2
curl
vulnerability
http
transfers
read callback
data
memory
put request

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

5.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

47.2%

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Affected configurations

NVD
Node
haxxcurlRange<8.1.0
Node
fedoraprojectfedoraMatch37
OR
fedoraprojectfedoraMatch38
Node
applemacosRange11.0โ€“11.7.9
OR
applemacosRange12.0โ€“12.6.8
OR
applemacosRange13.0โ€“13.5
Node
netappclustered_data_ontapMatch-
OR
netappontap_antivirus_connectorMatch-
Node
netapph300sMatch-
AND
netapph300s_firmwareMatch-
Node
netapph500sMatch-
AND
netapph500s_firmwareMatch-
Node
netapph700sMatch-
AND
netapph700s_firmwareMatch-
Node
netapph410sMatch-
AND
netapph410s_firmwareMatch-

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

5.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

47.2%