Moderate: curl security update
Summary
ALSA-2023:1140: Moderate: curl security update. Affects curl versions < 7.61.1-25.el8_7.3. Fixed in 7.61.1-25.el8_7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package provides the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It is commonly used in web applications and command-line tools for making HTTP requests.
Vulnerability Detail
The vulnerability (CVE-2023-23916) in curl is related to HTTP multi-header compression and can lead to a denial of service (DoS) attack. An attacker can exploit this vulnerability by sending specially crafted HTTP requests that trigger excessive memory usage, causing the server to become unresponsive or crash. The impact of this vulnerability can range from service disruption to complete system compromise.
How To Fix
Minimum fixed version
7.61.1-25.el8_7.3
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to mitigate the risk.
Conclusion
In conclusion, the curl package is affected by a moderate-level vulnerability that can result in a denial of service (DoS) attack. It is crucial to update the package to the recommended version to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
The vulnerability can lead to a denial of service (DoS) attack, potentially causing service disruption or system compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package manifest file (e.g., package-lock.json) and it will analyze and alert you in real-time.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is always recommended to apply security updates promptly to mitigate the risk.
Yes, this vulnerability can be exploited remotely by sending specially crafted HTTP requests to the affected server.
The CVSS score for this vulnerability has not been provided in the available information.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
