Log in Start free

Vulnerability · Published Oct 18, 2023 · Assigned by hackerone

CVE-2023-38546

Low 3.7

In plain English

A low-severity security flaw in curl from curl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.0% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)3.7Low
Exploit odds (30 days)6.0%top 6.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8curl7.61.1-33.el8_9.5ALSA-2024:1601
AlmaLinux:9curl7.76.1-23.el9_2.4ALSA-2023:5763
AlmaLinux:9curl7.76.1-26.el9_3.2ALSA-2023:6745
AlmaLinux:9curl-minimal7.76.1-26.el9_3.2ALSA-2023:6745
AlmaLinux:9curl-minimal7.76.1-23.el9_2.4ALSA-2023:5763
AlmaLinux:8libcurl7.61.1-33.el8_9.5ALSA-2024:1601
AlmaLinux:9libcurl7.76.1-26.el9_3.2ALSA-2023:6745
AlmaLinux:9libcurl7.76.1-23.el9_2.4ALSA-2023:5763
AlmaLinux:8libcurl-devel7.61.1-33.el8_9.5ALSA-2024:1601
AlmaLinux:9libcurl-devel7.76.1-26.el9_3.2ALSA-2023:6745
AlmaLinux:9libcurl-devel7.76.1-23.el9_2.4ALSA-2023:5763
AlmaLinux:8libcurl-minimal7.61.1-33.el8_9.5ALSA-2024:1601
AlmaLinux:9libcurl-minimal7.76.1-26.el9_3.2ALSA-2023:6745
AlmaLinux:9libcurl-minimal7.76.1-23.el9_2.4ALSA-2023:5763
Alpine:v3.20curl8.4.0-r0ALPINE-CVE-2023-38546
Alpine:v3.21curl8.4.0-r0ALPINE-CVE-2023-38546
Alpine:v3.22curl8.4.0-r0ALPINE-CVE-2023-38546
Alpine:v3.23curl8.4.0-r0ALPINE-CVE-2023-38546
Alpine:v3.24curl8.4.0-r0ALPINE-CVE-2023-38546
Debian:12curl7.88.1-10+deb12u4DSA-5523-1
Debian:12curl7.88.1-10+deb12u4DEBIAN-CVE-2023-38546
Debian:13curl8.3.0-3DEBIAN-CVE-2023-38546
Debian:14curl8.3.0-3DEBIAN-CVE-2023-38546
Rocky Linux:8curl0:7.61.1-33.el8_9.5RLSA-2024:1601
Rocky Linux:9curl0:7.76.1-23.el9_2.4RLSA-2023:5763
Ubuntu:22.04:LTScurl7.81.0-1ubuntu1.14USN-6429-1
Ubuntu:22.04:LTScurl7.81.0-1ubuntu1.14UBUNTU-CVE-2023-38546
Ubuntu:24.04:LTScurl8.2.1-1ubuntu3.1UBUNTU-CVE-2023-38546

Affected products (as reported)

VendorProductVersions
curl curl 8.4.0 – before 8.4.0

References