VulnerabilityModified
CVE-2023-46219
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
MEDIUM 5.3EPSS 1.13%
Does this matter?
Lower severity and a low EPSS score (1.13%). Track it; it rarely justifies an emergency change on its own.
Description
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 1.13% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-311
- Affected
- haxx/curl · fedoraproject/fedora
- Source
- support@hackerone.com
References
- https://curl.se/docs/CVE-2023-46219.htmlVendor Advisory
- https://hackerone.com/reports/2236133Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240119-0007/
- https://www.debian.org/security/2023/dsa-5587
- https://curl.se/docs/CVE-2023-46219.htmlVendor Advisory
- https://hackerone.com/reports/2236133Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240119-0007/
- https://www.debian.org/security/2023/dsa-5587
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-093430.html
- https://cert-portal.siemens.com/productcert/html/ssa-331112.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.