Düşük CVSS 3.7 PoC var

CVE-2023-28322: Curl: hassas bilgi ifşası

Yayın: 27 Mayıs 2023 00:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Özet bilgiler

Ürün: Haxx Curl
CVSS v3.1: 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: %2,21 (yüzdelik 83)
CWE: CWE-200
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
haxx-curl	—	—	8.1.0
fedoraproject-fedora	37	37	—
fedoraproject-fedora	38	38	—
apple-macos	11.0	—	11.7.9
apple-macos	12.0	—	12.6.8
apple-macos	13.0	—	13.5
netapp-clustered-data-ontap	—	—	—
netapp-ontap-antivirus-connector	—	—	—
netapp-h300s-firmware	—	—	—
netapp-h500s-firmware	—	—	—
netapp-h700s-firmware	—	—	—
netapp-h410s-firmware	—	—	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları