kritisch
CVE-2023-23914
curl: HSTS ignored on multiple requests
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Julia9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Azure Linux, CBL-Mariner, Julia, Photon OS. Niedriger laut Red Hat (mittel), Amazon (mittel), Ubuntu (niedrig).
Beschreibung
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Azure Linux 3.0 | cmake, tensorflow | 0:3.21.4-10.azl3 und 1 weitere |
| CBL-Mariner 1.0 | curl | 0:7.88.1-1.cm1 |
| CBL-Mariner 2.0 | cmake, curl | 0:3.21.4-6.cm2 und 1 weitere |
| julia::Julia Ecosystem Security Advisories | CURL_jll, LibCURL_jll | 8.5.0+0 und 1 weitere |
| Photon OS 3.0 | curl | 7.86.0-4.ph3 |
| Photon OS 4.0 | curl, curl-devel, curl-libs | 7.86.0-4.ph4 |
| Photon OS 5.0 | cmake | 3.25.2-4.ph5 |
| alpine 3.14 | curl | 7.79.1-r5 |
| alpine 3.15 | curl | 7.80.0-r6 |
| alpine 3.16 | curl | 7.83.1-r6 |
| alpine 3.17 | curl | 7.87.0-r2 |
| alpine 3.18 | curl | 7.88.0-r0 |
Alle 68 Einträge aus 37 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Azure Linux 3.0 | cmake | 0:3.21.4-10.azl3 |
| Azure Linux 3.0 | tensorflow | 0:2.16.1-1.azl3 |
| CBL-Mariner 1.0 | curl | 0:7.88.1-1.cm1 |
| CBL-Mariner 2.0 | cmake | 0:3.21.4-6.cm2 |
| CBL-Mariner 2.0 | curl | 0:7.88.1-1.cm2 |
| julia::Julia Ecosystem Security Advisories | CURL_jll | 8.5.0+0 |
| julia::Julia Ecosystem Security Advisories | LibCURL_jll | 7.88.1+0 |
| Photon OS 3.0 | curl | 7.86.0-4.ph3 |
| Photon OS 4.0 | curl | 7.86.0-4.ph4 |
| Photon OS 4.0 | curl-devel | 7.86.0-4.ph4 |
| Photon OS 4.0 | curl-libs | 7.86.0-4.ph4 |
| Photon OS 5.0 | cmake | 3.25.2-4.ph5 |
| alpine 3.14 | curl | 7.79.1-r5 |
| alpine 3.15 | curl | 7.80.0-r6 |
| alpine 3.16 | curl | 7.83.1-r6 |
| alpine 3.17 | curl | 7.87.0-r2 |
| alpine 3.18 | curl | 7.88.0-r0 |
| alpine 3.19 | curl | 7.88.0-r0 |
| alpine 3.20 | curl | 7.88.0-r0 |
| alpine 3.21 | curl | 7.88.0-r0 |
| alpine 3.22 | curl | 7.88.0-r0 |
| alpine 3.23 | curl | 7.88.0-r0 |
| alpine 3.24 | curl | 7.88.0-r0 |
| alpine edge | curl | 7.88.0-r0 |
| amazon linux 2 | curl | 7.88.0-1.amzn2.0.1 |
| amazon linux 2 | curl-debuginfo | 7.88.0-1.amzn2.0.1 |
| amazon linux 2 | libcurl | 7.88.0-1.amzn2.0.1 |
| amazon linux 2 | libcurl-devel | 7.88.0-1.amzn2.0.1 |
| amazon linux 2023 | curl | 7.88.0-1.amzn2023.0.1 |
| amazon linux 2023 | curl-debuginfo | 7.88.0-1.amzn2023.0.1 |
| amazon linux 2023 | curl-debugsource | 7.88.0-1.amzn2023.0.1 |
| amazon linux 2023 | curl-minimal | 7.88.0-1.amzn2023.0.1 |
| amazon linux 2023 | curl-minimal-debuginfo | 7.88.0-1.amzn2023.0.1 |
| amazon linux 2023 | libcurl | 7.88.0-1.amzn2023.0.1 |
| amazon linux 2023 | libcurl-debuginfo | 7.88.0-1.amzn2023.0.1 |
| amazon linux 2023 | libcurl-devel | 7.88.0-1.amzn2023.0.1 |
| amazon linux 2023 | libcurl-minimal | 7.88.0-1.amzn2023.0.1 |
| amazon linux 2023 | libcurl-minimal-debuginfo | 7.88.0-1.amzn2023.0.1 |
| debian 11 | curl | kein Fix angegeben |
| debian 12 | curl | 7.88.1-1 |
| debian 13 | curl | 7.88.1-1 |
| debian 14 | curl | 7.88.1-1 |
| echo | curl | 7.88.1-1 |
| echo | curl-7.69.1 | 7.69.1+e1 |
| echo | curl-8.1.1 | 7.88.0 |
| echo | curl-8.17.0 | 7.88.0 |
| echo | curl-8.8.0 | 7.88.0 |
| rapidfort amazon linux 2023 | curl | 0:7.88.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | curl-minimal | 7.88.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | libcurl | 0:7.88.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | libcurl-devel | 7.88.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | rf-curl | 0:7.88.0-1.amzn2023.0.1 |
| rapidfort ubuntu 20.04 | curl | 0:7.81.0-1ubuntu1.8 |
| rapidfort ubuntu 20.04 | rf-curl | 0:7.81.0-1ubuntu1.8 |
| rapidfort ubuntu 22.04 | curl | 0:7.81.0-1ubuntu1.8 |
| rapidfort ubuntu 22.04 | rf-curl | 0:7.81.0-1ubuntu1.8 |
| rapidfort ubuntu 24.04 | curl | 0:7.81.0-1ubuntu1.8 |
| rapidfort ubuntu 24.04 | rf-curl | 0:7.81.0-1ubuntu1.8 |
| Red Hat | rh-dotnet31-curl | kein Fix angegeben |
| Red Hat | rh-dotnet31-libcurl | kein Fix angegeben |
| Red Hat | rh-dotnet31-libcurl-devel | kein Fix angegeben |
| root.io debian 11 | curl | 7.74.0-1.3+deb11u13.root.io.3, 7.74.0-1.3+deb11u13.root.io.4, 7.74.0-1.3+deb11u13.root.io.12, 7.74.0-1.3+deb11u15.root.io.5, 7.74.0-1.3+deb11u15.root.io.6, 7.74.0-1.3+deb11u15.root.io.7, 7.74.0-1.3+deb11u15.root.io.8, 7.74.0-1.3+deb11u15.root.io.9, 7.74.0-1.3+deb11u15.root.io.10, 7.74.0-1.3+deb11u15.root.io.11, 7.74.0-1.3+deb11u16.root.io.13, 7.74.0-1.3+deb11u16.root.io.14 |
| root.io debian 11 | rootio-curl | 7.74.0-1.3+deb11u13.root.io.3, 7.74.0-1.3+deb11u13.root.io.4, 7.74.0-1.3+deb11u13.root.io.12, 7.74.0-1.3+deb11u15.root.io.5, 7.74.0-1.3+deb11u15.root.io.6, 7.74.0-1.3+deb11u15.root.io.7, 7.74.0-1.3+deb11u15.root.io.8, 7.74.0-1.3+deb11u15.root.io.9, 7.74.0-1.3+deb11u15.root.io.10, 7.74.0-1.3+deb11u15.root.io.11, 7.74.0-1.3+deb11u16.root.io.13, 7.74.0-1.3+deb11u16.root.io.14 |
| root.io debian 12 | rootio-curl | 7.88.1-1 |
| root.io debian 13 | rootio-curl | 7.88.1-1 |
| ubuntu 22.04 | curl | 7.81.0-1ubuntu1.8 |
| ubuntu 22.10 | curl | 7.85.0-1ubuntu0.3 |
| ubuntu 23.04 | curl | 7.87.0-2ubuntu1 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2023-23914
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://curl.se/docs/CVE-2023-23914.html
- https://hackerone.com/reports/1813864
- https://nvd.nist.gov/vuln/detail/CVE-2023-23914
- https://security.gentoo.org/glsa/202310-12
- https://security.netapp.com/advisory/ntap-20230309-0006/
- https://ubuntu.com/security/notices/USN-5891-1