Important: curl security update
Summary
ALSA-2023:5763: Important: curl security update. Affects curl versions < 7.76.1-23.el9_2.4. Fixed in 7.76.1-23.el9_2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package provides the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It is widely used in many applications and systems for network communication and data transfer.
Vulnerability Detail
This security update addresses two vulnerabilities in the curl package:
-
Heap-based buffer overflow in the SOCKS5 proxy handshake (CVE-2023-38545): This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by sending a specially crafted request to a vulnerable server.
-
Cookie injection with none file (CVE-2023-38546): This vulnerability could allow an attacker to inject arbitrary cookies into a user's session, potentially leading to session hijacking or other malicious activities.
How To Fix
Minimum fixed version
7.76.1-23.el9_2.4
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is important to update the curl package to the latest version to mitigate the identified vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for curl →
FAQ
The heap-based buffer overflow vulnerability (CVE-2023-38545) could potentially allow an attacker to execute arbitrary code or cause a denial of service. The cookie injection vulnerability (CVE-2023-38546) could lead to session hijacking or other malicious activities.
No, only versions prior to 7.76.1-23.el9_2.4 are affected. It is recommended to update to the latest version to mitigate the vulnerabilities.
No specific workaround has been provided for these vulnerabilities. It is recommended to update to the latest version of the curl package.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
You can refer to the CVE pages for more details:
- CVE-2023-38545: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38545
- CVE-2023-38546: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38546
Related vulnerabilities
Recent vulnerabilities recorded for curl.
