CVE-2023-28319
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.49% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- haxx/curl · apple/macos · netapp/clustered data ontap · netapp/ontap antivirus connector · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h410s firmware
- Source
- support@hackerone.com
References
- http://seclists.org/fulldisclosure/2023/Jul/47Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/48Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/52Mailing List, Third Party Advisory
- https://hackerone.com/reports/1913733Exploit, Patch, Third Party Advisory
- https://security.gentoo.org/glsa/202310-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230609-0009/Third Party Advisory
- https://support.apple.com/kb/HT213843Third Party Advisory
- https://support.apple.com/kb/HT213844Third Party Advisory
- https://support.apple.com/kb/HT213845Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/47Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/48Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/52Mailing List, Third Party Advisory
- https://hackerone.com/reports/1913733Exploit, Patch, Third Party Advisory
- https://security.gentoo.org/glsa/202310-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230609-0009/Third Party Advisory
- https://support.apple.com/kb/HT213843Third Party Advisory
- https://support.apple.com/kb/HT213844Third Party Advisory
- https://support.apple.com/kb/HT213845Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.