USN-6237-2
curl regression
USN-6237-1 fixed vulnerabilities in curl. The update caused a certificate wildcard handling regression on Ubuntu 22.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain certificate wildcards. A remote attacker could possibly use this issue to spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when certain options are set by applications. This could cause applications using curl to misbehave, resulting in information disclosure, or a denial of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A local attacker could possibly use this issue to create or overwrite files. This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)
What each source reports
OSV No score
curl regression
USN-6237-1 fixed vulnerabilities in curl. The update caused a certificate wildcard handling regression on Ubuntu 22.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain certificate wildcards. A remote attacker could possibly use this issue to spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when certain options are set by applications. This could cause applications using curl to misbehave, resulting in information disclosure, or a denial of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A local attacker could possibly use this issue to create or overwrite files. This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)
- Record
USN-6237-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlUbuntu:22.04:LTS |
before 7.81.0-1ubuntu1.13, plus listed versions 7.74.0-1.3ubuntu27.74.0-1.3ubuntu37.80.0-37.81.0-17.81.0-1ubuntu1.1 Show 8 moreShow less7.81.0-1ubuntu1.27.81.0-1ubuntu1.37.81.0-1ubuntu1.47.81.0-1ubuntu1.67.81.0-1ubuntu1.77.81.0-1ubuntu1.87.81.0-1ubuntu1.107.81.0-1ubuntu1.11 |
7.81.0-1ubuntu1.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-6237-2 is a vulnerability with no CVSS score yet in curl, published July 19, 2023. No source lists public exploit code. Fixed in curl 7.81.0-1ubuntu1.13.