curl vulnerabilities

2023-02-2712:34:20

Google

osv.dev

hsts support

unencrypted connections

ubuntu 22.04

ubuntu 22.10

memory handling

multi-header compression

denial of service

curl vulnerabilities

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

6.9

Confidence

Low

EPSS

0.002

Percentile

53.6%

JSON

Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested serially. A remote attacker could possibly
use this issue to cause curl to use unencrypted connections. This issue
only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23914)

Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested in parallel. A remote attacker could
possibly use this issue to cause curl to use unencrypted connections. This
issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23915)

Patrick Monnerat discovered that curl incorrectly handled memory when
processing requests with multi-header compression. A remote attacker could
possibly use this issue to cause curl to consume resources, leading to a
denial of service. (CVE-2023-23916)