NA

CVE-2023-28321

Published: 26/05/2023 Updated: 07/11/2023
CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2
VMScore: 0

Vulnerability Summary

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.

Vulnerable Product Search on Vulmon Subscribe to Product

haxx curl

debian debian linux 10.0

fedoraproject fedora 37

fedoraproject fedora 38

netapp clustered data ontap -

netapp ontap antivirus connector -

netapp h300s_firmware -

netapp h500s_firmware -

netapp h700s_firmware -

netapp h410s_firmware -

apple macos

Vendor Advisories

Debian Bug report logs - #1036239 curl: CVE-2023-28319 CVE-2023-28320 CVE-2023-28321 CVE-2023-28322 Package: src:curl; Maintainer for src:curl is Alessandro Ghedini &lt;ghedo@debianorg&gt;; Reported by: Salvatore Bonaccorso &lt;carnil@debianorg&gt; Date: Wed, 17 May 2023 20:57:02 UTC Severity: grave Tags: security, upstream F ...
Integer overflow vulnerability in tool_operatec in curl 7652 via crafted value as the retry delay (CVE-2020-19909) libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash This f ...
概述 Critical: Red Hat Advanced Cluster Management 281 security and bug fix updates 类型/严重性 Security Advisory: Critical 标题 Red Hat Advanced Cluster Management for Kubernetes 281 GeneralAvailability release images, which provide security updates and fix bugsRed Hat Product Security has rated this update as having a security ...
概述 Important: OpenShift Virtualization 4136 security and bug fix update 类型/严重性 Security Advisory: Important 标题 Red Hat OpenShift Virtualization release 4136 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security i ...
Synopsis Important: OpenShift Container Platform 4142 security and extras update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4142 is now available with updates to packages and images that fix several bugsThis release includes a security update for Red Hat OpenShift Container Platform 414 ...
Synopsis Important: OpenShift Container Platform 41244 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41244 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
Synopsis Important: OpenShift Container Platform 41244 security and extras update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41244 is now available with updates to packages and images that fix several bugsThis release includes a security update for Red Hat OpenShift Container Platform 4 ...
Synopsis Critical: Multicluster Engine for Kubernetes 227 security updates and bug fixes Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 227 General Availability release images, which provide security updates and fix bugsRed Hat Product Security has rated this update as having a security impactof Critic ...
Synopsis Important: OpenShift Virtualization 4141 security and bug fix update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 4141 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security imp ...
Synopsis Important: OpenShift Container Platform 41322 security and extras update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41322 is now available with updates to packages and images that fix several bugsThis release includes a security update for Red Hat OpenShift Container Platform 4 ...
Synopsis Moderate: curl security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for curl is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Security has rated this u ...
Synopsis Moderate: curl security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for curl is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security ...
Synopsis Important: Migration Toolkit for Containers (MTC) 180 security and bug fix update Type/Severity Security Advisory: Important Topic The Migration Toolkit for Containers (MTC) 180 is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ba ...
Synopsis Important: OpenShift Container Platform 41154 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41154 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
Synopsis Important: OpenShift Container Platform 41154 security and extras update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41154 is now available with updates to packages and images that fix several bugsThis release includes a security update for Red Hat OpenShift Container Platform 4 ...
Synopsis Important: OpenShift Virtualization 4133 Images security and bug fix update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 4133 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a secur ...
Synopsis Moderate: curl security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for curl is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security has rated this u ...
Synopsis Important: Network Observability 140 for OpenShift Type/Severity Security Advisory: Important Topic Network Observability is an OpenShift operator that deploys a monitoring pipeline to collect and enrich network flows that are produced by the Network Observability eBPF agentThe operator provides dashboards, metrics, and keeps flow ...
Synopsis Important: Red Hat OpenShift GitOps v193 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat OpenShift GitOps 19Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detaile ...
Synopsis Important: OpenShift Container Platform 41243 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41243 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
Synopsis Important: Red Hat OpenShift Enterprise security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat OpenShift Container Platform 412Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives ...
Synopsis Moderate: Migration Toolkit for Containers (MTC) 1713 security and bug fix update Type/Severity Security Advisory: Moderate Topic The Migration Toolkit for Containers (MTC) 1713 is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Important: Self Node Remediation Operator 051 security update Type/Severity Security Advisory: Important Topic This is an updated version of the Self Node Remediation Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Commo ...
Synopsis Important: Node Health Check Operator 041 Type/Severity Security Advisory: Important Topic This is an updated version of the Node Health Check Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...
Synopsis Important: Node Maintenance Operator 501 security update Type/Severity Security Advisory: Important Topic This is an updated version of the Node Maintenance Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerab ...
Synopsis Important: OpenShift Virtualization 4129 Images security and bug fix update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 4129 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a secur ...
Synopsis Critical: Red Hat Advanced Cluster Management 267 security and bug fix updates Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes 267 GeneralAvailability release images, which provide security updates and fix bugsRed Hat Product Security has rated this update as having a security i ...
Synopsis Moderate: OpenShift Virtualization 4126 Images Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Virtualization release 4126 is now available with updates to packages and images that fix several bugs and add enhancements Description OpenShift Virtualization is Red Hat's virtualization solution designed for Red ...
Synopsis Critical: Red Hat OpenShift GitOps security update Type/Severity Security Advisory: Critical Topic An update is now available for Red Hat OpenShift GitOps 19Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity ...
Synopsis Moderate: OpenShift Container Platform 4138 bug fix and security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4138 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Con ...
Synopsis Moderate: Red Hat JBoss Core Services Apache HTTP Server 2457 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat JBoss Core ServicesRed Hat Product Security h ...
Synopsis Moderate: Red Hat JBoss Core Services Apache HTTP Server 2457 security update Type/Severity Security Advisory: Moderate Topic Red Hat JBoss Core Services Apache HTTP Server 2457 is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Critical: Red Hat Advanced Cluster Management 277 security and bug fix updates Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes 277 GeneralAvailability release images, which provide security updates and fix bugsRed Hat Product Security has rated this update as having a security i ...
Synopsis Moderate: AMQ Broker 7111OPR2GA Container Images Release Type/Severity Security Advisory: Moderate Topic This is the multiarch release of the AMQ Broker 7111 aligned Operator and associated container images on Red Hat Enterprise Linux 8 for the OpenShift Container PlatformRed Hat Product Security has rated this update as havi ...
Synopsis Important: Release of OpenShift Serverless Logic 1300 SP1 security update Type/Severity Security Advisory: Important Topic Release of OpenShift Serverless Operator 1301 and OpenShift Serverless Logic 1300 SP1Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring S ...
Synopsis Important: Red Hat OpenShift Pipelines Operator security update Type/Severity Security Advisory: Important Topic An update is now available for OpenShift-Pipelines-111-RHEL-8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a ...
Synopsis Important: Self Node Remediation Operator 071 security update Type/Severity Security Advisory: Important Topic This is an updated version of the Self Node Remediation Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Commo ...
Synopsis Critical: Red Hat OpenShift GitOps security update Type/Severity Security Advisory: Critical Topic An update is now available for Red Hat OpenShift GitOps 18Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity ...
Synopsis Critical: Multicluster Engine for Kubernetes 218 security updates and bug fixes Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 218 General Availability release images, which fix bugs and update container imagesRed Hat Product Security has rated this update as having a security impactof Critica ...
Synopsis Moderate: Release of containers for OSP 162z (Train) director Operator Type/Severity Security Advisory: Moderate Topic Red Hat OpenStack Platform (RHOSP) 162z (Train) director Operator containers are now available Description Release of Red Hat OpenStack Platform (RHOSP) 162z (Train) provides these changes: Solution Before ...
Synopsis Moderate: OpenShift API for Data Protection (OADP) 116 security and bug fix update Type/Severity Security Advisory: Moderate Topic OpenShift API for Data Protection (OADP) 116 is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base ...
Synopsis Important: OpenShift Container Platform 41322 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41322 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
概要 Important: OpenShift Container Platform 411 low-latency extras update タイプ/重大度 Security Advisory: Important トピック An update for cnf-tests-container, dpdk-base-container and performance-addon-operator-must-gather-rhel8-container is now available for Red Hat OpenShift Container Platform 411 Secondary scheduler builds ...
Synopsis Important: OpenShift Container Platform 4142 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4142 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift C ...
Synopsis Important: DevWorkspace Operator 022 release Type/Severity Security Advisory: Important Topic Red Hat DevWorkspace Operator 022 has been releasedRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, i ...
Synopsis Important: Red Hat Single Sign-On 765 for OpenShift image enhancement and security update Type/Severity Security Advisory: Important Topic A new image is available for Red Hat Single Sign-On 765, running on OpenShift Container Platform 310 and 311, and 43Red Hat Product Security has rated this update as having a security impa ...
Synopsis Important: Red Hat OpenShift Pipelines 1106 release and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Pipelines 1106 has been releasedRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a ...
Synopsis Important: OpenShift Container Platform 413 low-latency extras security update Type/Severity Security Advisory: Important Topic An update for cnf-tests-container, dpdk-base-container, performance-addon-operator-must-gather NUMA-aware secondary scheduler and numaresources-operator is now available for Red Hat OpenShift Container Plat ...
Synopsis Important: Red Hat OpenShift Enterprise security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform low-latency extras release 412, which provides an update for cnf-tests-container, performance-addon-operator-must-gather-rhel8-container, NUMA-aware secondary scheduler and numaresources-opera ...
Synopsis Important: Secondary Scheduler Operator for Red Hat OpenShift 120 Type/Severity Security Advisory: Important Topic Secondary Scheduler Operator for Red Hat OpenShift 120 Description The Secondary Scheduler Operator for Red Hat OpenShift is an optionaloperator that makes it possible to deploy a secondary scheduler byproviding a ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the&nbsp;Apple security updates&nbsp;page Apple security documents reference vulnerabilities by&nbsp;CVE-ID&nbsp ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the&nbsp;Apple security updates&nbsp;page Apple security documents reference vulnerabilities by&nbsp;CVE-ID&nbsp ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the&nbsp;Apple security updates&nbsp;page Apple security documents reference vulnerabilities by&nbsp;CVE-ID&nbsp ...

Github Repositories

Assessing security of v8.0.1 of the CLI tool curl

Security Evaluation of curl Written in collaberation with Michael Choi, Theodore Lau, Adam Murtagh, Sami Hamide, Alexander West for UCLA CS 136, Computer Security Summary In this report, we assess and rate the security of version 801 of the well-known command-line URL data transfer tool curl We approached this analysis from three angles — researching previous vulnerab