Vulnerability-Lookup

UBUNTU-CVE-2023-27535 (CVE-2023-27535)

Vulnerability from osv_ubuntu – Published: 2023-03-20 00:00 – Updated: 2026-04-22 07:45 – Source website

Details

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2023-27535	REPORT
	https://curl.se/docs/CVE-2023-27535.html	REPORT
	https://ubuntu.com/security/notices/USN-5964-1	ADVISORY
	https://ubuntu.com/security/notices/USN-5964-2	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2023-27535	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.35.0-1ubuntu2.20+esm15"
          },
          {
            "binary_name": "libcurl3",
            "binary_version": "7.35.0-1ubuntu2.20+esm15"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.35.0-1ubuntu2.20+esm15"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.35.0-1ubuntu2.20+esm15"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.20+esm15?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.35.0-1ubuntu2.20+esm15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.32.0-1ubuntu1",
        "7.33.0-1ubuntu1",
        "7.34.0-1ubuntu1",
        "7.35.0-1ubuntu1",
        "7.35.0-1ubuntu2",
        "7.35.0-1ubuntu2.1",
        "7.35.0-1ubuntu2.2",
        "7.35.0-1ubuntu2.3",
        "7.35.0-1ubuntu2.5",
        "7.35.0-1ubuntu2.6",
        "7.35.0-1ubuntu2.7",
        "7.35.0-1ubuntu2.8",
        "7.35.0-1ubuntu2.9",
        "7.35.0-1ubuntu2.10",
        "7.35.0-1ubuntu2.11",
        "7.35.0-1ubuntu2.12",
        "7.35.0-1ubuntu2.13",
        "7.35.0-1ubuntu2.14",
        "7.35.0-1ubuntu2.15",
        "7.35.0-1ubuntu2.16",
        "7.35.0-1ubuntu2.17",
        "7.35.0-1ubuntu2.19",
        "7.35.0-1ubuntu2.20",
        "7.35.0-1ubuntu2.20+esm2",
        "7.35.0-1ubuntu2.20+esm3",
        "7.35.0-1ubuntu2.20+esm4",
        "7.35.0-1ubuntu2.20+esm5",
        "7.35.0-1ubuntu2.20+esm6",
        "7.35.0-1ubuntu2.20+esm7",
        "7.35.0-1ubuntu2.20+esm8",
        "7.35.0-1ubuntu2.20+esm9",
        "7.35.0-1ubuntu2.20+esm10",
        "7.35.0-1ubuntu2.20+esm11",
        "7.35.0-1ubuntu2.20+esm12",
        "7.35.0-1ubuntu2.20+esm13",
        "7.35.0-1ubuntu2.20+esm14"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.47.0-1ubuntu2.19+esm8"
          },
          {
            "binary_name": "libcurl3",
            "binary_version": "7.47.0-1ubuntu2.19+esm8"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.47.0-1ubuntu2.19+esm8"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.47.0-1ubuntu2.19+esm8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.47.0-1ubuntu2.19+esm8?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.47.0-1ubuntu2.19+esm8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.43.0-1ubuntu2",
        "7.45.0-1ubuntu1",
        "7.46.0-1ubuntu1",
        "7.47.0-1ubuntu1",
        "7.47.0-1ubuntu2",
        "7.47.0-1ubuntu2.1",
        "7.47.0-1ubuntu2.2",
        "7.47.0-1ubuntu2.3",
        "7.47.0-1ubuntu2.4",
        "7.47.0-1ubuntu2.5",
        "7.47.0-1ubuntu2.6",
        "7.47.0-1ubuntu2.7",
        "7.47.0-1ubuntu2.8",
        "7.47.0-1ubuntu2.9",
        "7.47.0-1ubuntu2.11",
        "7.47.0-1ubuntu2.12",
        "7.47.0-1ubuntu2.13",
        "7.47.0-1ubuntu2.14",
        "7.47.0-1ubuntu2.15",
        "7.47.0-1ubuntu2.16",
        "7.47.0-1ubuntu2.18",
        "7.47.0-1ubuntu2.19",
        "7.47.0-1ubuntu2.19+esm1",
        "7.47.0-1ubuntu2.19+esm2",
        "7.47.0-1ubuntu2.19+esm3",
        "7.47.0-1ubuntu2.19+esm4",
        "7.47.0-1ubuntu2.19+esm5",
        "7.47.0-1ubuntu2.19+esm6",
        "7.47.0-1ubuntu2.19+esm7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.58.0-2ubuntu3.24"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.58.0-2ubuntu3.24"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.58.0-2ubuntu3.24"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.58.0-2ubuntu3.24"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.58.0-2ubuntu3.24?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.58.0-2ubuntu3.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.55.1-1ubuntu2",
        "7.55.1-1ubuntu2.1",
        "7.57.0-1ubuntu1",
        "7.58.0-2ubuntu1",
        "7.58.0-2ubuntu2",
        "7.58.0-2ubuntu3",
        "7.58.0-2ubuntu3.1",
        "7.58.0-2ubuntu3.2",
        "7.58.0-2ubuntu3.3",
        "7.58.0-2ubuntu3.5",
        "7.58.0-2ubuntu3.6",
        "7.58.0-2ubuntu3.7",
        "7.58.0-2ubuntu3.8",
        "7.58.0-2ubuntu3.9",
        "7.58.0-2ubuntu3.10",
        "7.58.0-2ubuntu3.12",
        "7.58.0-2ubuntu3.13",
        "7.58.0-2ubuntu3.14",
        "7.58.0-2ubuntu3.15",
        "7.58.0-2ubuntu3.16",
        "7.58.0-2ubuntu3.17",
        "7.58.0-2ubuntu3.18",
        "7.58.0-2ubuntu3.19",
        "7.58.0-2ubuntu3.20",
        "7.58.0-2ubuntu3.21",
        "7.58.0-2ubuntu3.22",
        "7.58.0-2ubuntu3.23"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.68.0-1ubuntu2.18"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.68.0-1ubuntu2.18"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.68.0-1ubuntu2.18"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.68.0-1ubuntu2.18"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.18?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.68.0-1ubuntu2.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.65.3-1ubuntu3",
        "7.65.3-1ubuntu4",
        "7.66.0-1ubuntu1",
        "7.67.0-2ubuntu1",
        "7.68.0-1ubuntu1",
        "7.68.0-1ubuntu2",
        "7.68.0-1ubuntu2.1",
        "7.68.0-1ubuntu2.2",
        "7.68.0-1ubuntu2.4",
        "7.68.0-1ubuntu2.5",
        "7.68.0-1ubuntu2.6",
        "7.68.0-1ubuntu2.7",
        "7.68.0-1ubuntu2.10",
        "7.68.0-1ubuntu2.11",
        "7.68.0-1ubuntu2.12",
        "7.68.0-1ubuntu2.13",
        "7.68.0-1ubuntu2.14",
        "7.68.0-1ubuntu2.15",
        "7.68.0-1ubuntu2.16"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.81.0-1ubuntu1.10"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.81.0-1ubuntu1.10"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.81.0-1ubuntu1.10"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.81.0-1ubuntu1.10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.10?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.81.0-1ubuntu1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.74.0-1.3ubuntu2",
        "7.74.0-1.3ubuntu3",
        "7.80.0-3",
        "7.81.0-1",
        "7.81.0-1ubuntu1.1",
        "7.81.0-1ubuntu1.2",
        "7.81.0-1ubuntu1.3",
        "7.81.0-1ubuntu1.4",
        "7.81.0-1ubuntu1.6",
        "7.81.0-1ubuntu1.7",
        "7.81.0-1ubuntu1.8"
      ]
    }
  ],
  "aliases": [],
  "details": "An authentication bypass vulnerability exists in libcurl \u003c8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.",
  "id": "UBUNTU-CVE-2023-27535",
  "modified": "2026-04-22T07:45:16Z",
  "published": "2023-03-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-27535"
    },
    {
      "type": "REPORT",
      "url": "https://curl.se/docs/CVE-2023-27535.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5964-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5964-2"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27535"
    }
  ],
  "related": [
    "USN-5964-1",
    "USN-5964-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2023-27535"
  ]
}

CVE-2023-27535 (GCVE-0-2023-27535)

Vulnerability from cvelistv5 – Published: 2023-03-30 00:00 – Updated: 2025-06-09 14:47

Summary

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-03 18:24 UTC

CWE

CWE-305 - Authentication Bypass by Primary Weakness (CWE-305)

Assigner

hackerone mitre root Scorecard

References

5 references

URL	Tags
https://hackerone.com/reports/1892780
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://security.netapp.com/advisory/ntap-2023042…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202310-12	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	https://github.com/curl/curl	Affected: Fixed in 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:16:35.540Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1892780"
          },
          {
            "name": "FEDORA-2023-7e7414e64d",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230420-0010/"
          },
          {
            "name": "[debian-lts-announce] 20230421 [SECURITY] [DLA 3398-1] curl security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html"
          },
          {
            "name": "GLSA-202310-12",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202310-12"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-27535",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-03T18:24:11.710118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-09T14:47:57.951Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/curl/curl",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An authentication bypass vulnerability exists in libcurl \u003c8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "Authentication Bypass by Primary Weakness (CWE-305)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-11T10:06:20.841Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/1892780"
        },
        {
          "name": "FEDORA-2023-7e7414e64d",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230420-0010/"
        },
        {
          "name": "[debian-lts-announce] 20230421 [SECURITY] [DLA 3398-1] curl security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html"
        },
        {
          "name": "GLSA-202310-12",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202310-12"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-27535",
    "datePublished": "2023-03-30T00:00:00.000Z",
    "dateReserved": "2023-03-02T00:00:00.000Z",
    "dateUpdated": "2025-06-09T14:47:57.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

USN-5964-1 (UBUNTU-CVE-2023-27533)

Vulnerability from osv_ubuntu – Published: 2023-03-20 12:30 – Updated: 2026-04-22 07:37 – Source website

Summary

curl vulnerabilities

Details

Harry Sintonen discovered that curl incorrectly handled certain TELNET connection options. Due to lack of proper input scrubbing, curl could pass on user name and telnet options to the server as provided, contrary to expectations. (CVE-2023-27533)

Harry Sintonen discovered that curl incorrectly handled special tilde characters when used with SFTP paths. A remote attacker could possibly use this issue to circumvent filtering. (CVE-2023-27534)

Harry Sintonen discovered that curl incorrectly reused certain FTP connections. This could lead to the wrong credentials being reused, contrary to expectations. (CVE-2023-27535)

Harry Sintonen discovered that curl incorrectly reused connections when the GSS delegation option had been changed. This could lead to the option being reused, contrary to expectations. (CVE-2023-27536)

Harry Sintonen discovered that curl incorrectly reused certain SSH connections. This could lead to the wrong credentials being reused, contrary to expectations. (CVE-2023-27538)

References

URL

Type

	https://ubuntu.com/security/notices/USN-5964-1	ADVISORY
	https://ubuntu.com/security/CVE-2023-27533	REPORT
	https://ubuntu.com/security/CVE-2023-27534	REPORT
	https://ubuntu.com/security/CVE-2023-27535	REPORT
	https://ubuntu.com/security/CVE-2023-27536	REPORT
	https://ubuntu.com/security/CVE-2023-27538	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-27533",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27534",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27535",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27536",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27538",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.58.0-2ubuntu3.24"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.58.0-2ubuntu3.24"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.58.0-2ubuntu3.24"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.58.0-2ubuntu3.24"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.58.0-2ubuntu3.24?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.58.0-2ubuntu3.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.55.1-1ubuntu2",
        "7.55.1-1ubuntu2.1",
        "7.57.0-1ubuntu1",
        "7.58.0-2ubuntu1",
        "7.58.0-2ubuntu2",
        "7.58.0-2ubuntu3",
        "7.58.0-2ubuntu3.1",
        "7.58.0-2ubuntu3.2",
        "7.58.0-2ubuntu3.3",
        "7.58.0-2ubuntu3.5",
        "7.58.0-2ubuntu3.6",
        "7.58.0-2ubuntu3.7",
        "7.58.0-2ubuntu3.8",
        "7.58.0-2ubuntu3.9",
        "7.58.0-2ubuntu3.10",
        "7.58.0-2ubuntu3.12",
        "7.58.0-2ubuntu3.13",
        "7.58.0-2ubuntu3.14",
        "7.58.0-2ubuntu3.15",
        "7.58.0-2ubuntu3.16",
        "7.58.0-2ubuntu3.17",
        "7.58.0-2ubuntu3.18",
        "7.58.0-2ubuntu3.19",
        "7.58.0-2ubuntu3.20",
        "7.58.0-2ubuntu3.21",
        "7.58.0-2ubuntu3.22",
        "7.58.0-2ubuntu3.23"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-27533",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27534",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27535",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27536",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27538",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.68.0-1ubuntu2.18"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.68.0-1ubuntu2.18"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.68.0-1ubuntu2.18"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.68.0-1ubuntu2.18"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.18?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.68.0-1ubuntu2.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.65.3-1ubuntu3",
        "7.65.3-1ubuntu4",
        "7.66.0-1ubuntu1",
        "7.67.0-2ubuntu1",
        "7.68.0-1ubuntu1",
        "7.68.0-1ubuntu2",
        "7.68.0-1ubuntu2.1",
        "7.68.0-1ubuntu2.2",
        "7.68.0-1ubuntu2.4",
        "7.68.0-1ubuntu2.5",
        "7.68.0-1ubuntu2.6",
        "7.68.0-1ubuntu2.7",
        "7.68.0-1ubuntu2.10",
        "7.68.0-1ubuntu2.11",
        "7.68.0-1ubuntu2.12",
        "7.68.0-1ubuntu2.13",
        "7.68.0-1ubuntu2.14",
        "7.68.0-1ubuntu2.15",
        "7.68.0-1ubuntu2.16"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-27533",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27534",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27535",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27536",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27538",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.81.0-1ubuntu1.10"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.81.0-1ubuntu1.10"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.81.0-1ubuntu1.10"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.81.0-1ubuntu1.10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.10?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.81.0-1ubuntu1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.74.0-1.3ubuntu2",
        "7.74.0-1.3ubuntu3",
        "7.80.0-3",
        "7.81.0-1",
        "7.81.0-1ubuntu1.1",
        "7.81.0-1ubuntu1.2",
        "7.81.0-1ubuntu1.3",
        "7.81.0-1ubuntu1.4",
        "7.81.0-1ubuntu1.6",
        "7.81.0-1ubuntu1.7",
        "7.81.0-1ubuntu1.8"
      ]
    }
  ],
  "aliases": [],
  "details": "Harry Sintonen discovered that curl incorrectly handled certain TELNET\nconnection options. Due to lack of proper input scrubbing, curl could pass\non user name and telnet options to the server as provided, contrary to\nexpectations. (CVE-2023-27533)\n\nHarry Sintonen discovered that curl incorrectly handled special tilde\ncharacters when used with SFTP paths. A remote attacker could possibly use\nthis issue to circumvent filtering. (CVE-2023-27534)\n\nHarry Sintonen discovered that curl incorrectly reused certain FTP\nconnections. This could lead to the wrong credentials being reused,\ncontrary to expectations. (CVE-2023-27535)\n\nHarry Sintonen discovered that curl incorrectly reused connections when the\nGSS delegation option had been changed. This could lead to the option being\nreused, contrary to expectations. (CVE-2023-27536)\n\nHarry Sintonen discovered that curl incorrectly reused certain SSH\nconnections. This could lead to the wrong credentials being reused,\ncontrary to expectations. (CVE-2023-27538)\n",
  "id": "USN-5964-1",
  "modified": "2026-04-22T07:37:04Z",
  "published": "2023-03-20T12:30:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5964-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-27533"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-27534"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-27535"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-27536"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-27538"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "curl vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2023-27533",
    "UBUNTU-CVE-2023-27534",
    "UBUNTU-CVE-2023-27535",
    "UBUNTU-CVE-2023-27536",
    "UBUNTU-CVE-2023-27538"
  ]
}

USN-5964-2 (UBUNTU-CVE-2023-27533)

Vulnerability from osv_ubuntu – Published: 2023-03-27 14:47 – Updated: 2026-06-29 10:53 – Source website

Summary

curl vulnerabilities

Details

USN-5964-1 fixed several vulnerabilities in curl. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

Harry Sintonen discovered that curl incorrectly reused certain FTP connections. This could lead to the wrong credentials being reused, contrary to expectations. (CVE-2023-27535)

References

URL

Type

	https://ubuntu.com/security/notices/USN-5964-2	ADVISORY
	https://ubuntu.com/security/CVE-2023-27533	REPORT
	https://ubuntu.com/security/CVE-2023-27535	REPORT
	https://ubuntu.com/security/CVE-2023-27536	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-27533",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27535",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27536",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.35.0-1ubuntu2.20+esm15"
          },
          {
            "binary_name": "libcurl3",
            "binary_version": "7.35.0-1ubuntu2.20+esm15"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.35.0-1ubuntu2.20+esm15"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.35.0-1ubuntu2.20+esm15"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.20+esm15?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.35.0-1ubuntu2.20+esm15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.32.0-1ubuntu1",
        "7.33.0-1ubuntu1",
        "7.34.0-1ubuntu1",
        "7.35.0-1ubuntu1",
        "7.35.0-1ubuntu2",
        "7.35.0-1ubuntu2.1",
        "7.35.0-1ubuntu2.2",
        "7.35.0-1ubuntu2.3",
        "7.35.0-1ubuntu2.5",
        "7.35.0-1ubuntu2.6",
        "7.35.0-1ubuntu2.7",
        "7.35.0-1ubuntu2.8",
        "7.35.0-1ubuntu2.9",
        "7.35.0-1ubuntu2.10",
        "7.35.0-1ubuntu2.11",
        "7.35.0-1ubuntu2.12",
        "7.35.0-1ubuntu2.13",
        "7.35.0-1ubuntu2.14",
        "7.35.0-1ubuntu2.15",
        "7.35.0-1ubuntu2.16",
        "7.35.0-1ubuntu2.17",
        "7.35.0-1ubuntu2.19",
        "7.35.0-1ubuntu2.20",
        "7.35.0-1ubuntu2.20+esm2",
        "7.35.0-1ubuntu2.20+esm3",
        "7.35.0-1ubuntu2.20+esm4",
        "7.35.0-1ubuntu2.20+esm5",
        "7.35.0-1ubuntu2.20+esm6",
        "7.35.0-1ubuntu2.20+esm7",
        "7.35.0-1ubuntu2.20+esm8",
        "7.35.0-1ubuntu2.20+esm9",
        "7.35.0-1ubuntu2.20+esm10",
        "7.35.0-1ubuntu2.20+esm11",
        "7.35.0-1ubuntu2.20+esm12",
        "7.35.0-1ubuntu2.20+esm13",
        "7.35.0-1ubuntu2.20+esm14"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-27533",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27535",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-27536",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.47.0-1ubuntu2.19+esm8"
          },
          {
            "binary_name": "libcurl3",
            "binary_version": "7.47.0-1ubuntu2.19+esm8"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.47.0-1ubuntu2.19+esm8"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.47.0-1ubuntu2.19+esm8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.47.0-1ubuntu2.19+esm8?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.47.0-1ubuntu2.19+esm8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.43.0-1ubuntu2",
        "7.45.0-1ubuntu1",
        "7.46.0-1ubuntu1",
        "7.47.0-1ubuntu1",
        "7.47.0-1ubuntu2",
        "7.47.0-1ubuntu2.1",
        "7.47.0-1ubuntu2.2",
        "7.47.0-1ubuntu2.3",
        "7.47.0-1ubuntu2.4",
        "7.47.0-1ubuntu2.5",
        "7.47.0-1ubuntu2.6",
        "7.47.0-1ubuntu2.7",
        "7.47.0-1ubuntu2.8",
        "7.47.0-1ubuntu2.9",
        "7.47.0-1ubuntu2.11",
        "7.47.0-1ubuntu2.12",
        "7.47.0-1ubuntu2.13",
        "7.47.0-1ubuntu2.14",
        "7.47.0-1ubuntu2.15",
        "7.47.0-1ubuntu2.16",
        "7.47.0-1ubuntu2.18",
        "7.47.0-1ubuntu2.19",
        "7.47.0-1ubuntu2.19+esm1",
        "7.47.0-1ubuntu2.19+esm2",
        "7.47.0-1ubuntu2.19+esm3",
        "7.47.0-1ubuntu2.19+esm4",
        "7.47.0-1ubuntu2.19+esm5",
        "7.47.0-1ubuntu2.19+esm6",
        "7.47.0-1ubuntu2.19+esm7"
      ]
    }
  ],
  "aliases": [],
  "details": "USN-5964-1 fixed several vulnerabilities in curl. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n Harry Sintonen discovered that curl incorrectly handled certain TELNET\n connection options. Due to lack of proper input scrubbing, curl could pass\n on user name and telnet options to the server as provided, contrary to\n expectations. (CVE-2023-27533)\n\n Harry Sintonen discovered that curl incorrectly reused certain FTP\n connections. This could lead to the wrong credentials being reused,\n contrary to expectations. (CVE-2023-27535)\n\n Harry Sintonen discovered that curl incorrectly reused connections when the\n GSS delegation option had been changed. This could lead to the option being\n reused, contrary to expectations. (CVE-2023-27536)\n",
  "id": "USN-5964-2",
  "modified": "2026-06-29T10:53:00Z",
  "published": "2023-03-27T14:47:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5964-2"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-27533"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-27535"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-27536"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "curl vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2023-27533",
    "UBUNTU-CVE-2023-27535",
    "UBUNTU-CVE-2023-27536"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

UBUNTU-CVE-2023-27535 (CVE-2023-27535)

CVE-2023-27535 (GCVE-0-2023-27535)

USN-5964-1 (UBUNTU-CVE-2023-27533)

USN-5964-2 (UBUNTU-CVE-2023-27533)

Tags

Sightings

Nomenclature

Related by attack behaviour