Published: 12/12/2023 Updated: 19/01/2024

CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9

VMScore: 0

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx curl
fedoraproject fedora 38

Debian Bug report logs - #1057646 curl: CVE-2023-46218 Package: src:curl; Maintainer for src:curl is Debian Curl Maintainers <team+curl@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 6 Dec 2023 13:45:04 UTC Severity: important Tags: security, upstream Found in versions curl/7 ...

Debian Bug report logs - #1057645 curl: CVE-2023-46219 Package: src:curl; Maintainer for src:curl is Debian Curl Maintainers <team+curl@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 6 Dec 2023 13:45:01 UTC Severity: important Tags: security, upstream Found in versions curl/8 ...

Two security issues were discovered in Curl: Cookies were incorrectly validated against the public suffix list of domains and in same cases HSTS data could fail to save to disk For the oldstable distribution (bullseye), these problems have been fixed in version 7740-13+deb11u11 For the stable distribution (bookworm), these problems have been f ...

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible This allows a site to set cookies that then would get sent to different and unrelated sites and domains It could do this by exploiting a mixed case flaw in curl's function that verifies a giv ...

DescriptionThe MITRE CVE dictionary describes this issue as: When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use ...

Policy Reporter Plugins Monorepo

Policy Reporter Plugins Monorepo Introduction With Policy Reporter UI v2 a new plugin system will be introduced While plugins in v1 were only used for integrating the Policy Reporter Kyverno Plugin, the new system will be more generic and needs to provide a defined set of REST APIs, no actual UI changes are required Plugin information will be included in existing views and pr

CWE-311 https://hackerone.com/reports/2236133 https://curl.se/docs/CVE-2023-46219.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/https://www.debian.org/security/2023/dsa-5587 https://security.netapp.com/advisory/ntap-20240119-0007/https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057646 https://github.com/kyverno/policy-reporter-plugins https://www.debian.org/security/2023/dsa-5587

CVE-2023-46219

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect