CVE-2023-28322

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.(CVE-2023-28322)

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with xn-- and should not be allowed to pattern match, but the wildcard check in curl could still check for x*, which would match even though the IDN name most likely contained nothing even resembling an x.(CVE-2023-28321)

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: IDN wildcard match may lead to Improper Cerificate Validation (CVE-2023-28321)
• curl: more POST-after-PUT confusion (CVE-2023-28322)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218)
• curl: more POST-after-PUT confusion (CVE-2023-28322)
• curl: cookie injection with none file (CVE-2023-38546)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• libssh (curl sftp) not trying password auth (BZ#2240033)
• libssh: cap SFTP packet size sent (AlmaLinux-5485)

• CVE-2023-28322: fix errouneous behaviour and possible use-after-free due to mess in upload/method handling
• CVE-2023-28321: fix incorrect IDN wildcard match due to errouneous wildcard logic handling; drop support for wildcards in the middle of domain name
• Update certificates used on test HTTPS server

• CVE-2023-28322: fix errouneous behaviour and possible use-after-free due to mess in upload/method handling
• CVE-2023-28321: fix incorrect IDN wildcard match due to errouneous wildcard logic handling; drop support for wildcards in the middle of domain name
• Update certificates used on test HTTPS server

• SECURITY UPDATE: More POST-after-PUT confusion
  • debian/patches/CVE-2023-28322.patch: fix mess in upload/method handling
  • CVE-2023-28322

• SECURITY UPDATE: More POST-after-PUT confusion
  • debian/patches/CVE-2023-28322.patch: fix mess in upload/method handling
  • CVE-2023-28322
• SECURITY UPDATE: incorrect IDN wildcard match
  • debian/patches/CVE-2023-28321.patch: fix erroneous logic in wildcard handling, drop support for wildcards in the middle of domain name
  • CVE-2023-28321

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback.

This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer.

The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

TELNET option IAC injection. (CVE-2023-27533)

SFTP path ~ resolving discrepancy. (CVE-2023-27534)

FTP too eager connection reuse. (CVE-2023-27535)

GSS delegation too eager connection re-use. (CVE-2023-27536)

HSTS double free. (CVE-2023-27537)

SSH connection too eager reuse still. (CVE-2023-27538)

UAF in SSH sha256 fingerprint check. (CVE-2023-28319)

siglongjmp race condition. (CVE-2023-28320)

IDN wildcard match. (CVE-2023-28321)

more POST-after-PUT confusion. (CVE-2023-28322)

HTTP headers eat all memory. (CVE-2023-38039)

These are all security issues fixed in the curl-8.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218)

• curl: more POST-after-PUT confusion (CVE-2023-28322)

• curl: cookie injection with none file (CVE-2023-38546)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• libssh (curl sftp) not trying password auth (BZ#2240033)

• libssh: cap SFTP packet size sent (Rocky Linux-5485)

This update for curl adds the following feature:

Update to version 8.0.1 (jsc#PED-2580)

• CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
• CVE-2023-28320: siglongjmp race condition (bsc#1211231).
• CVE-2023-28321: IDN wildcard matching (bsc#1211232).
• CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).

This update for curl adds the following feature:

Update to version 8.0.1 (jsc#PED-2580)

• CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
• CVE-2023-28320: siglongjmp race condition (bsc#1211231).
• CVE-2023-28321: IDN wildcard matching (bsc#1211232).
• CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).

This update for curl adds the following feature:

Update to version 8.0.1 (jsc#PED-2580)

• CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
• CVE-2023-28320: siglongjmp race condition (bsc#1211231).
• CVE-2023-28321: IDN wildcard matching (bsc#1211232).
• CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).

This update for curl fixes the following issues:

• CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
• CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
• CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
• CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).
• CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).
• CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).
• CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).
• CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).
• CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).
• CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).

This update for curl fixes the following issues:

• CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
• CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
• CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).

This update for curl fixes the following issues:

• CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
• CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
• CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
• CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).
• CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).
• CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).
• CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).
• CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).
• CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).
• CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).

This update for curl fixes the following issues:

• CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
• CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
• CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).

Hiroki Kurosawa discovered that curl incorrectly handled validating certain certificate wildcards. A remote attacker could possibly use this issue to spoof certain website certificates using IDN hosts. (CVE-2023-28321)

Hiroki Kurosawa discovered that curl incorrectly handled callbacks when certain options are set by applications. This could cause applications using curl to misbehave, resulting in information disclosure, or a denial of service. (CVE-2023-28322)

It was discovered that curl incorrectly handled saving cookies to files. A local attacker could possibly use this issue to create or overwrite files. This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)

USN-6237-1 fixed several vulnerabilities in curl. This update provides the corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.

Original advisory details:

Hiroki Kurosawa discovered that curl incorrectly handled validating certain certificate wildcards. A remote attacker could possibly use this issue to spoof certain website certificates using IDN hosts. (CVE-2023-28321)

Hiroki Kurosawa discovered that curl incorrectly handled callbacks when certain options are set by applications. This could cause applications using curl to misbehave, resulting in information disclosure, or a denial of service. (CVE-2023-28322)

It was discovered that curl incorrectly handled saving cookies to files. A local attacker could possibly use this issue to create or overwrite files. This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)