Vulnerability-Lookup

RHSA-2023:6679

Vulnerability from csaf_opensuse - Published: 2023-11-07 00:00 - Updated: 2026-09-20 11:33

Summary

security update for curl

Severity

Low

Notes

Title of the patch: security update for curl

Description of the patch: This security update provides a functional equivalent of RHSA-2023:6679. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2023:6679.

Patchnames: RHSA-2023:6679

CVE-2023-27533

4.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2023-27534

4.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-27533

Threats

Impact moderate

CVE-2023-27536

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-27533

Threats

Impact moderate

CVE-2023-27538

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-27533

Threats

Impact moderate

References

14 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2023-27533/	self
https://www.suse.com/security/cve/CVE-2023-27534/	self
https://www.suse.com/security/cve/CVE-2023-27536/	self
https://www.suse.com/security/cve/CVE-2023-27538/	self
https://www.suse.com/security/cve/CVE-2023-27533	external
https://bugzilla.suse.com/1209209	external
https://www.suse.com/security/cve/CVE-2023-27534	external
https://bugzilla.suse.com/1209210	external
https://www.suse.com/security/cve/CVE-2023-27536	external
https://bugzilla.suse.com/1209212	external
https://www.suse.com/security/cve/CVE-2023-27538	external
https://bugzilla.suse.com/1209214	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2023:6679.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2023:6679.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2023:6679",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2023_6679.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-27533 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-27533/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-27534 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-27534/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-27536 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-27536/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-27538 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-27538/"
      }
    ],
    "title": "security update for curl",
    "tracking": {
      "current_release_date": "2026-09-20T11:33:02Z",
      "generator": {
        "date": "2023-11-07T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2023:6679",
      "initial_release_date": "2023-11-07T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-11-07T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:33:02Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-0:7.76.1-26.el9.i686",
                "product": {
                  "name": "libcurl-0:7.76.1-26.el9.i686",
                  "product_id": "libcurl-0:7.76.1-26.el9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libcurl@7.76.1-26.el9?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.76.1-26.el9.i686",
                "product": {
                  "name": "libcurl-devel-0:7.76.1-26.el9.i686",
                  "product_id": "libcurl-devel-0:7.76.1-26.el9.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:haxx:curl:7.76.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libcurl-devel@7.76.1-26.el9?arch=i686\u0026upstream=curl-0:7.76.1-26.el9.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.76.1-26.el9.i686",
                "product": {
                  "name": "libcurl-minimal-0:7.76.1-26.el9.i686",
                  "product_id": "libcurl-minimal-0:7.76.1-26.el9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libcurl-minimal@7.76.1-26.el9?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.76.1-26.el9.x86_64",
                "product": {
                  "name": "curl-0:7.76.1-26.el9.x86_64",
                  "product_id": "curl-0:7.76.1-26.el9.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:haxx:curl:7.76.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/curl@7.76.1-26.el9?arch=x86_64\u0026upstream=curl-0:7.76.1-26.el9.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-0:7.76.1-26.el9.x86_64",
                "product": {
                  "name": "curl-minimal-0:7.76.1-26.el9.x86_64",
                  "product_id": "curl-minimal-0:7.76.1-26.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/curl-minimal@7.76.1-26.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.76.1-26.el9.x86_64",
                "product": {
                  "name": "libcurl-0:7.76.1-26.el9.x86_64",
                  "product_id": "libcurl-0:7.76.1-26.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libcurl@7.76.1-26.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.76.1-26.el9.x86_64",
                "product": {
                  "name": "libcurl-devel-0:7.76.1-26.el9.x86_64",
                  "product_id": "libcurl-devel-0:7.76.1-26.el9.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:haxx:curl:7.76.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libcurl-devel@7.76.1-26.el9?arch=x86_64\u0026upstream=curl-0:7.76.1-26.el9.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.76.1-26.el9.x86_64",
                "product": {
                  "name": "libcurl-minimal-0:7.76.1-26.el9.x86_64",
                  "product_id": "libcurl-minimal-0:7.76.1-26.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libcurl-minimal@7.76.1-26.el9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.76.1-26.el9.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64"
        },
        "product_reference": "curl-0:7.76.1-26.el9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-0:7.76.1-26.el9.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64"
        },
        "product_reference": "curl-minimal-0:7.76.1-26.el9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.76.1-26.el9.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686"
        },
        "product_reference": "libcurl-0:7.76.1-26.el9.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.76.1-26.el9.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64"
        },
        "product_reference": "libcurl-0:7.76.1-26.el9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.76.1-26.el9.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686"
        },
        "product_reference": "libcurl-devel-0:7.76.1-26.el9.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.76.1-26.el9.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64"
        },
        "product_reference": "libcurl-devel-0:7.76.1-26.el9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.76.1-26.el9.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686"
        },
        "product_reference": "libcurl-minimal-0:7.76.1-26.el9.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.76.1-26.el9.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
        },
        "product_reference": "libcurl-minimal-0:7.76.1-26.el9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-27533",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-27533"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application\u0027s intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-27533",
          "url": "https://www.suse.com/security/cve/CVE-2023-27533"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209209 for CVE-2023-27533",
          "url": "https://bugzilla.suse.com/1209209"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-07T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-27533"
    },
    {
      "cve": "CVE-2023-27534",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-27534"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A path traversal vulnerability exists in curl \u003c8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user\u0027s home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-27534",
          "url": "https://www.suse.com/security/cve/CVE-2023-27534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209210 for CVE-2023-27534",
          "url": "https://bugzilla.suse.com/1209210"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-07T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-27534"
    },
    {
      "cve": "CVE-2023-27536",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-27536"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authentication bypass vulnerability exists libcurl \u003c8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-27536",
          "url": "https://www.suse.com/security/cve/CVE-2023-27536"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209212 for CVE-2023-27536",
          "url": "https://bugzilla.suse.com/1209212"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-07T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-27536"
    },
    {
      "cve": "CVE-2023-27538",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-27538"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
          "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
          "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-27538",
          "url": "https://www.suse.com/security/cve/CVE-2023-27538"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209214 for CVE-2023-27538",
          "url": "https://bugzilla.suse.com/1209214"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:curl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:curl-minimal-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-devel-0:7.76.1-26.el9.x86_64",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.i686",
            "SUSE Liberty Linux 9:libcurl-minimal-0:7.76.1-26.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-07T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-27538"
    }
  ]
}

CVE-2023-27533 (GCVE-0-2023-27533)

Vulnerability from cvelistv5 – Published: 2023-03-30 00:00 – Updated: 2026-02-13 20:09

Summary

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-13 20:09 UTC

CWE

CWE-75 - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)

Assigner

hackerone mitre root

References

5 references

URL	Tags
https://hackerone.com/reports/1891474
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://security.netapp.com/advisory/ntap-2023042…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202310-12	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	https://github.com/curl/curl	Affected: Fixed in 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:16:35.624Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1891474"
          },
          {
            "name": "FEDORA-2023-7e7414e64d",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230420-0011/"
          },
          {
            "name": "[debian-lts-announce] 20230421 [SECURITY] [DLA 3398-1] curl security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html"
          },
          {
            "name": "GLSA-202310-12",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202310-12"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-27533",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-13T20:09:15.311824Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-13T20:09:17.704Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/curl/curl",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application\u0027s intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-75",
              "description": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-11T10:06:42.278Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/1891474"
        },
        {
          "name": "FEDORA-2023-7e7414e64d",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230420-0011/"
        },
        {
          "name": "[debian-lts-announce] 20230421 [SECURITY] [DLA 3398-1] curl security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html"
        },
        {
          "name": "GLSA-202310-12",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202310-12"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-27533",
    "datePublished": "2023-03-30T00:00:00.000Z",
    "dateReserved": "2023-03-02T00:00:00.000Z",
    "dateUpdated": "2026-02-13T20:09:17.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-27534 (GCVE-0-2023-27534)

Vulnerability from cvelistv5 – Published: 2023-03-30 00:00 – Updated: 2026-09-18 15:03

Summary

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 13:29 UTC

CWE

CWE-22 - Path Traversal (CWE-22)

Assigner

hackerone mitre root

References

5 references

URL	Tags
https://hackerone.com/reports/1892351
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://security.netapp.com/advisory/ntap-2023042…
https://security.gentoo.org/glsa/202310-12	vendor-advisory
https://lists.debian.org/debian-lts-announce/2024…	mailing-list

Impacted products

1 product

Vendor	Product	Version
n/a	https://github.com/curl/curl	Affected: Fixed in 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:16:35.536Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1892351"
          },
          {
            "name": "FEDORA-2023-7e7414e64d",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230420-0012/"
          },
          {
            "name": "GLSA-202310-12",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202310-12"
          },
          {
            "name": "[debian-lts-announce] 20240317 [SECURITY] [DLA 3763-1] curl security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-27534",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:29:22.277594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T15:03:53.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/curl/curl",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path traversal vulnerability exists in curl \u003c8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user\u0027s home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal (CWE-22)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-17T12:05:55.110Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/1892351"
        },
        {
          "name": "FEDORA-2023-7e7414e64d",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230420-0012/"
        },
        {
          "name": "GLSA-202310-12",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202310-12"
        },
        {
          "name": "[debian-lts-announce] 20240317 [SECURITY] [DLA 3763-1] curl security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-27534",
    "datePublished": "2023-03-30T00:00:00.000Z",
    "dateReserved": "2023-03-02T00:00:00.000Z",
    "dateUpdated": "2026-09-18T15:03:53.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-27536 (GCVE-0-2023-27536)

Vulnerability from cvelistv5 – Published: 2023-03-30 00:00 – Updated: 2025-02-14 15:39

Summary

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-14 15:39 UTC

CWE

CWE-305 - Authentication Bypass by Primary Weakness (CWE-305)

Assigner

hackerone mitre root

References

5 references

URL	Tags
https://hackerone.com/reports/1895135
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://security.netapp.com/advisory/ntap-2023042…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202310-12	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	https://github.com/curl/curl	Affected: Fixed in 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:16:35.616Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1895135"
          },
          {
            "name": "FEDORA-2023-7e7414e64d",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230420-0010/"
          },
          {
            "name": "[debian-lts-announce] 20230421 [SECURITY] [DLA 3398-1] curl security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html"
          },
          {
            "name": "GLSA-202310-12",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202310-12"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-27536",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-14T15:39:19.648695Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-14T15:39:25.676Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/curl/curl",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An authentication bypass vulnerability exists libcurl \u003c8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "Authentication Bypass by Primary Weakness (CWE-305)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-11T10:06:17.316Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/1895135"
        },
        {
          "name": "FEDORA-2023-7e7414e64d",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230420-0010/"
        },
        {
          "name": "[debian-lts-announce] 20230421 [SECURITY] [DLA 3398-1] curl security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html"
        },
        {
          "name": "GLSA-202310-12",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202310-12"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-27536",
    "datePublished": "2023-03-30T00:00:00.000Z",
    "dateReserved": "2023-03-02T00:00:00.000Z",
    "dateUpdated": "2025-02-14T15:39:25.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-27538 (GCVE-0-2023-27538)

Vulnerability from cvelistv5 – Published: 2023-03-30 00:00 – Updated: 2025-06-09 14:52

Summary

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-09 14:52 UTC

CWE

CWE-305 - Authentication Bypass by Primary Weakness (CWE-305)

Assigner

hackerone mitre root

References

4 references

URL	Tags
https://hackerone.com/reports/1898475
https://security.netapp.com/advisory/ntap-2023042…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202310-12	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	https://github.com/curl/curl	Affected: Fixed in 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:16:35.616Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1898475"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230420-0010/"
          },
          {
            "name": "[debian-lts-announce] 20230421 [SECURITY] [DLA 3398-1] curl security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html"
          },
          {
            "name": "GLSA-202310-12",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202310-12"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-27538",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-09T14:52:04.392274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-09T14:52:08.739Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/curl/curl",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "Authentication Bypass by Primary Weakness (CWE-305)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-11T10:06:34.473Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/1898475"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230420-0010/"
        },
        {
          "name": "[debian-lts-announce] 20230421 [SECURITY] [DLA 3398-1] curl security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html"
        },
        {
          "name": "GLSA-202310-12",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202310-12"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-27538",
    "datePublished": "2023-03-30T00:00:00.000Z",
    "dateReserved": "2023-03-02T00:00:00.000Z",
    "dateUpdated": "2025-06-09T14:52:08.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2023:6679

CVE-2023-27533 (GCVE-0-2023-27533)

CVE-2023-27534 (GCVE-0-2023-27534)

CVE-2023-27536 (GCVE-0-2023-27536)

CVE-2023-27538 (GCVE-0-2023-27538)

Tags

Sightings

Nomenclature

Related by attack behaviour