Lucene search

K
osvGoogleOSV:CURL-CVE-2023-27536
HistoryMar 20, 2023 - 8:00 a.m.

GSS delegation too eager connection re-use

2023-03-2008:00:00
Google
osv.dev
1
gss delegation
libcurl
connection pool
krb5
kerberos
gssapi

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.2%

libcurl would reuse a previously created connection even when the GSS
delegation (CURLOPT_GSSAPI_DELEGATION) option had been changed that could
have changed the user’s permissions in a second transfer.

libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup. However, this GSS
delegation setting was left out from the configuration match checks, making
them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers.

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.2%