Vulmon
Amazon Linux 2 Security Advisory: ALAS-2024-2385
Advisory Release Date: 2024-01-03 21:04 Pacific
Advisory Updated Date: 2024-01-09 17:58 Pacific
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.
It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL used a lowercase hostname curl.co.uk, even though co.uk is listed as a PSL domain. (CVE-2023-46218)
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)
Affected Packages:
curl
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
"Run yum update curl to update your system.
"
aarch64:
curl-8.3.0-1.amzn2.0.5.aarch64
libcurl-8.3.0-1.amzn2.0.5.aarch64
libcurl-devel-8.3.0-1.amzn2.0.5.aarch64
curl-debuginfo-8.3.0-1.amzn2.0.5.aarch64
i686:
curl-8.3.0-1.amzn2.0.5.i686
libcurl-8.3.0-1.amzn2.0.5.i686
libcurl-devel-8.3.0-1.amzn2.0.5.i686
curl-debuginfo-8.3.0-1.amzn2.0.5.i686
src:
curl-8.3.0-1.amzn2.0.5.src
x86_64:
curl-8.3.0-1.amzn2.0.5.x86_64
libcurl-8.3.0-1.amzn2.0.5.x86_64
libcurl-devel-8.3.0-1.amzn2.0.5.x86_64
curl-debuginfo-8.3.0-1.amzn2.0.5.x86_64