Lucene search
RedHatRHSA-2023:7540HistoryNov 28, 2023 - 2:46 p.m.
(RHSA-2023:7540) Low: curl security and bug fix update
2023-11-2814:46:10
access.redhat.com
49
curl
security
bug fix
libcurl
http
ftp
ldap
cookie injection
cvss score
libssh
sftp
password auth
cve-2023-38546
bz#2240032
CVSS3
3.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AI Score
7.8
Confidence
Low
EPSS
0.001
Percentile
40.8%
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
- curl: cookie injection with none file (CVE-2023-38546)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- libssh (curl sftp) not trying password auth (BZ#2240032)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| RedHat | 8 | ppc64le | curl | < 7.61.1-30.el8_8.6 | curl-7.61.1-30.el8_8.6.ppc64le.rpm |
| RedHat | 8 | ppc64le | libcurl | < 7.61.1-30.el8_8.6 | libcurl-7.61.1-30.el8_8.6.ppc64le.rpm |
| RedHat | 8 | i686 | curl-minimal-debuginfo | < 7.61.1-30.el8_8.6 | curl-minimal-debuginfo-7.61.1-30.el8_8.6.i686.rpm |
| RedHat | 8 | s390x | libcurl-devel | < 7.61.1-30.el8_8.6 | libcurl-devel-7.61.1-30.el8_8.6.s390x.rpm |
| RedHat | 8 | i686 | libcurl-devel | < 7.61.1-30.el8_8.6 | libcurl-devel-7.61.1-30.el8_8.6.i686.rpm |
| RedHat | 8 | ppc64le | libcurl-minimal-debuginfo | < 7.61.1-30.el8_8.6 | libcurl-minimal-debuginfo-7.61.1-30.el8_8.6.ppc64le.rpm |
| RedHat | 8 | s390x | libcurl-minimal | < 7.61.1-30.el8_8.6 | libcurl-minimal-7.61.1-30.el8_8.6.s390x.rpm |
| RedHat | 8 | i686 | curl-debuginfo | < 7.61.1-30.el8_8.6 | curl-debuginfo-7.61.1-30.el8_8.6.i686.rpm |
| RedHat | 8 | s390x | curl-minimal-debuginfo | < 7.61.1-30.el8_8.6 | curl-minimal-debuginfo-7.61.1-30.el8_8.6.s390x.rpm |
| RedHat | 8 | s390x | libcurl | < 7.61.1-30.el8_8.6 | libcurl-7.61.1-30.el8_8.6.s390x.rpm |
Related
ubuntucve
ubuntucve
CVE-2023-38546
2023-10-11 00:00:00
osv
osv
CVE-2023-38546
2023-10-18 04:15:11
CGA-prv4-p5wj-wmm6
2024-06-06 12:26:15
CGA-92xv-rcxh-vr3p
2024-06-06 12:25:43
veracode
veracode
Cookie Injection
2023-10-12 08:53:47
prion
prion
Design/Logic Flaw
2023-10-18 04:15:00
cbl_mariner
cbl_mariner
CVE-2023-38546 affecting package cmake for versions less than 3.21.4-10
2023-10-21 15:00:39
CVE-2023-38546 affecting package curl for versions less than 8.3.0-2
2023-10-12 19:11:35
CVE-2023-38546 affecting package cmake for versions less than 3.21.4-10
2024-03-19 17:21:46
nessus
nessus
EulerOS 2.0 SP5 : curl (EulerOS-SA-2024-1136)
2024-02-08 00:00:00
SUSE SLES15 Security Update : curl (SUSE-SU-2023:4045-1)
2023-10-13 00:00:00
openvas
openvas
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2024-1647)
2024-05-16 00:00:00
Ubuntu: Security Advisory (USN-6429-2)
2023-10-12 00:00:00
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2024-1136)
2024-02-09 00:00:00
cvelist
cvelist
CVE-2023-38546
2023-10-18 03:51:31
wolfi
wolfi
CVE-2023-38546 vulnerabilities
2024-09-27 09:13:12
ibm
ibm
Security Bulletin: IBM Storage Ceph is vulnerable to External Control of File Name or Path in the RHEL UBI (CVE-2023-38546)
2024-08-05 20:17:06
redhatcve
redhatcve
CVE-2023-38546
2023-10-11 13:11:32
debiancve
debiancve
CVE-2023-38546
2023-10-18 04:15:11
f5
f5
K000137211 : cURL vulnerabilities CVE-2023-38546
2023-10-11 00:00:00
hackerone
hackerone
curl: CVE-2023-38546: cookie injection with none file
2023-09-14 14:58:50
Internet Bug Bounty: [CVE-2023-38546] cookie injection with none file
2023-10-19 10:01:36
ubuntu
ubuntu
curl vulnerability
2023-10-11 00:00:00
curl vulnerabilities
2023-10-17 00:00:00
curl vulnerabilities
2023-10-11 00:00:00
cve
cve
CVE-2023-38546
2023-10-18 04:15:11
alpinelinux
alpinelinux
CVE-2023-38546
2023-10-18 04:15:11
nvd
nvd
CVE-2023-38546
2023-10-18 04:15:11
redhat
redhat
(RHSA-2024:2101) Low: Red Hat Satellite Client bug fix and security update
2024-04-29 15:24:50
(RHSA-2023:5700) Important: curl security update
2023-10-13 21:38:55
(RHSA-2023:6292) Moderate: curl security update
2023-11-02 15:53:46
cloudlinux
cloudlinux
curl: Fix of CVE-2023-38546
2023-10-16 13:58:12
cgr
cgr
CVE-2023-38546 vulnerabilities
2024-05-19 03:07:16
cloudfoundry
cloudfoundry
USN-6429-2: curl vulnerability | Cloud Foundry
2023-12-04 00:00:00
USN-6429-1: curl vulnerabilities | Cloud Foundry
2023-11-09 00:00:00
vulnrichment
vulnrichment
CVE-2023-38546
2023-10-18 03:51:31
fedora
fedora
[SECURITY] Fedora 39 Update: curl-8.2.1-3.fc39
2023-10-16 15:27:49
[SECURITY] Fedora 38 Update: curl-8.0.1-5.fc38
2023-10-14 01:32:18
[SECURITY] Fedora 37 Update: curl-7.85.0-12.fc37
2023-10-28 01:25:37
redos
redos
ROS-20231016-05
2023-10-16 00:00:00
oraclelinux
oraclelinux
curl security update
2023-11-16 00:00:00
curl security update
2023-10-18 00:00:00
curl security and bug fix update
2024-04-03 00:00:00
qualysblog
qualysblog
Curl 8.4.0 – Proactively Identifying Potential Vulnerable Assets
2023-10-06 00:14:06
slackware
slackware
[slackware-security] curl
2023-10-11 06:45:13
amazon
amazon
Important: curl
2023-10-10 21:19:00
aix
aix
Multiple vulnerabilities in cURL libcurl affect AIX
2023-12-11 13:22:02
debian
debian
[SECURITY] [DLA 3613-1] curl security update
2023-10-11 11:49:02
[SECURITY] [DSA 5523-1] curl security update
2023-10-11 06:58:41
almalinux
almalinux
Important: curl security update
2023-11-07 00:00:00
Important: curl security update
2023-10-17 00:00:00
Moderate: curl security and bug fix update
2024-04-02 00:00:00
thn
thn
Security Patch for Two New Flaws in Curl Library Arriving on October 11
2023-10-09 10:32:00
mageia
mageia
Updated the curl packages to fix two security vulnerabilities
2023-10-14 01:56:51
cisco
cisco
cURL and libcurl Vulnerability Affecting Cisco Products: October 2023
2023-10-12 16:00:00
paloalto
paloalto
Impact of curl and libcurl Vulnerabilities (CVE-2023-38545, CVE-2023-38546)
2023-10-12 20:40:00
rocky
rocky
curl security update
2023-10-24 18:36:52
curl security and bug fix update
2024-04-05 14:55:53
photon
photon
Critical Photon OS Security Update - PHSA-2023-5.0-0113
2023-10-11 00:00:00
Critical Photon OS Security Update - PHSA-2023-3.0-0667
2023-10-11 00:00:00
Critical Photon OS Security Update - PHSA-2023-4.0-0487
2023-10-11 00:00:00
ics
ics
Siemens RUGGEDCOM APE1808
2024-03-14 12:00:00
apple
apple
About the security content of macOS Monterey 12.7.3
2024-01-22 00:00:00
CVSS3
3.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AI Score
7.8
Confidence
Low
EPSS
0.001
Percentile
40.8%
Related for RHSA-2023:7540