Lucene search

K
osvGoogleOSV:USN-6237-3
HistorySep 11, 2023 - 6:00 p.m.

curl vulnerabilities

2023-09-1118:00:42
Google
osv.dev
2
curl vulnerabilities
ubuntu 14.04
ubuntu 16.04
ubuntu 18.04
certificate wildcards
idn hosts
information disclosure
denial of service
cookies
files
ubuntu 22.10
ubuntu 23.04

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

43.4%

USN-6237-1 fixed several vulnerabilities in curl. This update provides the
corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS.

Original advisory details:

Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)

Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)

It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could possibly use this issue to create or overwrite files.
This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)