CVE-2023-32001
libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called...
We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
What each source reports
EUVD Score usedEUVD-2023-36289
We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for.
- Record
EUVD-2023-36289- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
CVE List No score
We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for.
- Record
CVE-2023-32001- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xc3w-ghxg-pw5f No score
libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called...
libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When
doing this, it called stat() followed by fopen() in a way that made it
vulnerable to a TOCTOU race condition problem.
By exploiting this flaw, an attacker could trick the victim to create or overwrite protected files holding this data in ways it was not intended to.
- Record
GHSA-xc3w-ghxg-pw5f- Updated
- 2026-11-02
NVD No score
Rejected reason: We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for.
- Record
CVE-2023-32001- Updated
- 2026-11-02
OSVOESA-2023-1443
curl security update
cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.
Security Fix(es):
libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When
doing this, it called stat() followed by fopen() in a way that made it
vulnerable to a TOCTOU race condition problem.
By exploiting this flaw, an attacker could trick the victim to create or overwrite protected files holding this data in ways it was not intended to. (CVE-2023-32001)
- Record
OESA-2023-1443- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13069-1 No score
curl-8.2.0-1.1 on GA media
These are all security issues fixed in the curl-8.2.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13069-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2880-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2023-32001: Fixed TOCTOU race condition (bsc#1213237).
- Record
SUSE-SU-2023:2880-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2891-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2023-32001: Fixed TOCTOU race condition (bsc#1213237).
- Record
SUSE-SU-2023:2891-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlopenEuler:20.03-LTS-SP1 |
before 7.71.1-30.oe1 | 7.71.1-30.oe1 |
curlopenEuler:20.03-LTS-SP3 |
before 7.71.1-30.oe1 | 7.71.1-30.oe1 |
curlopenEuler:22.03-LTS |
before 7.79.1-23.oe2203sp2 | 7.79.1-23.oe2203sp2 |
curlopenEuler:22.03-LTS-SP1 |
before 7.79.1-23.oe2203sp1 | 7.79.1-23.oe2203sp1 |
curlopenEuler:22.03-LTS-SP2 |
before 7.79.1-23.oe2203sp2 | 7.79.1-23.oe2203sp2 |
curlSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 8.0.1-11.68.1 | 8.0.1-11.68.1 |
curlSUSE:Linux Enterprise Server 12 SP5 |
before 8.0.1-11.68.1 | 8.0.1-11.68.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 8.0.1-11.68.1 | 8.0.1-11.68.1 |
curlSUSE:Linux Enterprise Micro 5.3 |
before 8.0.1-150400.5.26.1 | 8.0.1-150400.5.26.1 |
curlSUSE:Linux Enterprise Micro 5.4 |
before 8.0.1-150400.5.26.1 | 8.0.1-150400.5.26.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 8.0.1-150400.5.26.1 | 8.0.1-150400.5.26.1 |
curlSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 8.0.1-150400.5.26.1 | 8.0.1-150400.5.26.1 |
curlopenSUSE:Leap Micro 5.3 |
before 8.0.1-150400.5.26.1 | 8.0.1-150400.5.26.1 |
curlopenSUSE:Leap 15.4 |
before 8.0.1-150400.5.26.1 | 8.0.1-150400.5.26.1 |
curlopenSUSE:Leap 15.5 |
before 8.0.1-150400.5.26.1 | 8.0.1-150400.5.26.1 |
curlopenSUSE:Tumbleweed |
before 8.2.0-1.1 | 8.2.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, severity | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-32001 has been rejected by its source and should not be treated as a live vulnerability, published July 19, 2023. Fixed in curl 7.71.1-30.oe1.