Log in Start free

Vulnerability · Published May 26, 2023 · Assigned by hackerone

CVE-2023-28319

High 7.5

In plain English

A high-severity use-after-free in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.5%top 15.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20curl8.1.0-r0ALPINE-CVE-2023-28319
Alpine:v3.21curl8.1.0-r0ALPINE-CVE-2023-28319
Alpine:v3.22curl8.1.0-r0ALPINE-CVE-2023-28319
Alpine:v3.23curl8.1.0-r0ALPINE-CVE-2023-28319
Alpine:v3.24curl8.1.0-r0ALPINE-CVE-2023-28319
Debian:12curl7.88.1-10DEBIAN-CVE-2023-28319
Debian:13curl7.88.1-10DEBIAN-CVE-2023-28319
Debian:14curl7.88.1-10DEBIAN-CVE-2023-28319
Ubuntu:22.04:LTScurl7.81.0-1ubuntu1.20UBUNTU-CVE-2023-28319

Affected products (as reported)

VendorProductVersions
n/a https://github.com/curl/curl Fixed in 8.1.0

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References