{"id":"CVE-2023-27533","aliases":["ALPINE-CVE-2023-27533","ALSA-2023:6679","AZL-25783","AZL-25804","AZL-25812","AZL-25894","AZL-34608","AZL-37878","BELL-CVE-2023-27533","CLSA-2023-1681490707","CLSA-2023-1681491163","CLSA-2023-1681491348","CLSA-2023-1681491543","CLSA-2023-1681491763","CLSA-2026-1776847322","CLSA-2026-1777463367","CLSA-2026-1777463593","CURL-CVE-2023-27533","DEBIAN-CVE-2023-27533","DLA-3398-1","EUVD-2023-31288","GHSA-xvw3-6q4f-2gcv","JLSEC-2026-405","MGASA-2023-0263","OESA-2023-1193","OESA-2023-1194","OESA-2023-1195","OESA-2023-1196","RHSA-2023:3354","RHSA-2023:6679","SUSE-SU-2023:0865-1","SUSE-SU-2023:1582-1","SUSE-SU-2023:1711-1","SUSE-SU-2023:2226-1","SUSE-SU-2023:2228-1","UBUNTU-CVE-2023-27533","USN-5964-1","USN-5964-2","openSUSE-SU-2024:12812-1"],"status":"published","title":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET...","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02156,"percentile":0.82436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-75"],"published":"2023-03-20T00:00:00Z","modified":"2026-10-29T11:31:34Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["8.0.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["8.0.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["8.0.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.88.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cmake","fixed_in":["3.21.4-12"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"mysql","fixed_in":["8.0.34-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"rust","fixed_in":["1.72.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["8.0.1-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.28.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"tensorflow","fixed_in":["2.16.1-1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"curl","fixed_in":["7.29.0-59.0.3.el7_9.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"libcurl","fixed_in":["7.29.0-59.0.3.el7_9.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"libcurl-devel","fixed_in":["7.29.0-59.0.3.el7_9.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"curl","fixed_in":["7.29.0-59.0.3.el7_9.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libcurl","fixed_in":["7.29.0-59.0.3.el7_9.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libcurl-devel","fixed_in":["7.29.0-59.0.3.el7_9.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.88.1-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.88.1-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.88.1-7"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.5.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.0.1+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.20+esm15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.19+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"curl","fixed_in":["7.81.0-1ubuntu1.10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.88.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.4-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.34-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.72.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-gnutls-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-nss-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-openssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-59.0.3.el7_9.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-59.0.3.el7_9.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-59.0.3.el7_9.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-59.0.3.el7_9.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-59.0.3.el7_9.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-59.0.3.el7_9.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-7"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u6"}]}],"versions":["7.64.0-4","7.64.0-4+deb10u1","7.64.0-4+deb10u2","7.64.0-4+deb10u3","7.64.0-4+deb10u4","7.64.0-4+deb10u5"],"bundled":4},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.5.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.13.mga8"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-3.1.mga9"}]}],"bundled":11},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-15.oe2203sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-24.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-24.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-15.oe2203"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-26.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.60.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.60.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.60.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-150400.5.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-150400.5.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-150400.5.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-150400.5.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-150000.51.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-150000.51.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-150000.51.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-150000.51.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm15"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13","7.35.0-1ubuntu2.20+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm8"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2","7.47.0-1ubuntu2.19+esm3","7.47.0-1ubuntu2.19+esm4","7.47.0-1ubuntu2.19+esm5","7.47.0-1ubuntu2.19+esm6","7.47.0-1ubuntu2.19+esm7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16","7.58.0-2ubuntu3.17","7.58.0-2ubuntu3.18","7.58.0-2ubuntu3.19","7.58.0-2ubuntu3.20","7.58.0-2ubuntu3.21","7.58.0-2ubuntu3.22","7.58.0-2ubuntu3.23"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.18"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15","7.68.0-1ubuntu2.16"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.10"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16","7.58.0-2ubuntu3.17","7.58.0-2ubuntu3.18","7.58.0-2ubuntu3.19","7.58.0-2ubuntu3.20","7.58.0-2ubuntu3.21","7.58.0-2ubuntu3.22","7.58.0-2ubuntu3.23"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.18"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15","7.68.0-1ubuntu2.16"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.10"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm15"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13","7.35.0-1ubuntu2.20+esm14"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm8"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2","7.47.0-1ubuntu2.19+esm3","7.47.0-1ubuntu2.19+esm4","7.47.0-1ubuntu2.19+esm5","7.47.0-1ubuntu2.19+esm6","7.47.0-1ubuntu2.19+esm7"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-1.1"}]}],"bundled":6}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1891474","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230420-0011/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html","tags":["mailing-list","x_transferred","Mailing List","article","web"]},{"url":"https://security.gentoo.org/glsa/202310-12","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-943925.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27533","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW"},{"url":"https://security.netapp.com/advisory/ntap-20230420-0011"},{"url":"https://github.com/advisories/GHSA-xvw3-6q4f-2gcv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-27533","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6679","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27533","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27534","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27536","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27538","tags":["report"]},{"url":"https://bugzilla.redhat.com/2179062","tags":["report"]},{"url":"https://bugzilla.redhat.com/2179069","tags":["report"]},{"url":"https://bugzilla.redhat.com/2179092","tags":["report"]},{"url":"https://bugzilla.redhat.com/2179103","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6679.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-27533","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2023-1681490707.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2023-1681491163.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1681491348","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2023-1681491543.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2023-1681491763.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1776847322.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1777463367.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27534","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1777463593.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-27533","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0263.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31703","tags":["report"]},{"url":"https://curl.se/docs/CVE-2023-27533.html","tags":["advisory","article","report"]},{"url":"https://curl.se/docs/CVE-2023-27534.html","tags":["advisory","article"]},{"url":"https://curl.se/docs/CVE-2023-27535.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27536.html","tags":["advisory","article"]},{"url":"https://curl.se/docs/CVE-2023-27537.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27538.html","tags":["advisory","article"]},{"url":"https://ubuntu.com/security/notices/USN-5964-1","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28319.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28320.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28321.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28322.html","tags":["advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-May/014913.html","tags":["web"]},{"url":"https://curl.se/docs/CVE-2023-32001.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-38039.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6363-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27535","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27536","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1194","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1195","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1196","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3354","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2152639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2152652","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2161774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167797","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169652","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179069","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3354.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-20001","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-20001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-20001","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2006-20001","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230207.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4450","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25147","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25147","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43551","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43551","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43551","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2022-43551.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43552","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43552","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2022-43552.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0215","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0286","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23914","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23914","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-23914.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23915","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23915","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-23915.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23916","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23916","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23916","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-23916.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25690","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27533","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27534","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179103","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6679.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27536","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27538","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230865-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1209209","tags":["report"]},{"url":"https://bugzilla.suse.com/1209210","tags":["report"]},{"url":"https://bugzilla.suse.com/1209211","tags":["report"]},{"url":"https://bugzilla.suse.com/1209212","tags":["report"]},{"url":"https://bugzilla.suse.com/1209214","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27538","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231582-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231711-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207992","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23916","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232226-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206309","tags":["report"]},{"url":"https://bugzilla.suse.com/1211231","tags":["report"]},{"url":"https://bugzilla.suse.com/1211232","tags":["report"]},{"url":"https://bugzilla.suse.com/1211233","tags":["report"]},{"url":"https://bugzilla.suse.com/1211339","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28322","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-27533","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5964-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-27534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27538","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27537","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-27533","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T00:00:00Z","modified":"2026-10-14T22:32:13.094Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-75"],"updated_at":"2026-11-02T14:35:26.63732Z"}],"euvd":[{"id":"EUVD-2023-31288","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T00:00:00Z","modified":"2026-10-14T22:32:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:11.209168Z"}],"ghsa":[{"id":"GHSA-xvw3-6q4f-2gcv","title":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET...","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T21:30:21Z","modified":"2026-10-15T00:31:41Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-75"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2023-27533","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T20:15:07.373Z","modified":"2026-10-14T23:17:16.033Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-75","CWE-74"],"updated_at":"2026-11-02T14:07:51.883939Z"}],"osv":[{"id":"ALPINE-CVE-2023-27533","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T20:15:07.373Z","modified":"2026-10-26T17:17:58.615169394Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.202584Z"},{"id":"AZL-25783","title":"CVE-2023-27533 affecting package cmake for versions less than 3.21.4-12","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T20:15:07Z","modified":"2026-04-21T04:23:13.865739Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-25804","title":"CVE-2023-27533 affecting package mysql for versions less than 8.0.34-1","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T20:15:07Z","modified":"2026-04-21T04:23:15.778511Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-25812","title":"CVE-2023-27533 affecting package rust for versions less than 1.72.0-2","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T20:15:07Z","modified":"2026-04-21T04:23:17.877283Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-25894","title":"CVE-2023-27533 affecting package curl for versions less than 8.0.1-1","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T20:15:07Z","modified":"2026-04-21T04:23:20.975466Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-34608","title":"CVE-2023-27533 affecting package cmake for versions less than 3.28.2-1","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T20:15:07Z","modified":"2026-04-21T04:33:52.127273Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-37878","title":"CVE-2023-27533 affecting package tensorflow for versions less than 2.16.1-1","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T20:15:07Z","modified":"2026-04-21T04:52:26.600287Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BELL-CVE-2023-27533","title":"CVE-2023-27533 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:51.209113Z","modified":"2026-01-26T09:47:43.858445Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-27533","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T20:15:07.373Z","modified":"2026-04-16T04:33:45.348549451Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"DEBIAN-CVE-2023-27533","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-30T20:15:07.373Z","modified":"2026-10-26T18:01:22.811083598Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"JLSEC-2026-405","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:01:56.389073334Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2023-1193","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nlibcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The settings in questions are `CURLOPT_FTP_ACCOUNT`, `CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL` level.(CVE-2023-27535)\r\n\r\nlibcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily.(CVE-2023-27538)\r\n\r\nlibcurl would reuse a previously created connection even when the GSS delegation (`CURLOPT_GSSAPI_DELEGATION`) option had been changed that could have changed the user\u0026apos;s permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers.(CVE-2023-27536)\r\n\r\ncurl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and \u0026quot;telnet options\u0026quot; for the server\nnegotiation. Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass on user name and telnet options to the server as provided. This could allow users to pass in carefully crafted content that pass on content or do option negotiation without the application intending to do so. In particular if an application for example allows users to provide the data or parts of the data.(CVE-2023-27533)\r\n\r\ncurl supports SFTP transfers. curl\u0026apos;s SFTP implementation offers a special feature in the path component of URLs: a tilde (`~`) character as the first\npath element in the path to denotes a path relative to the user\u0026apos;s home directory. This is supported because of wording in the [once proposed\nto-become RFC draft](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-scp-sftp-ssh-uri-04) that was to dictate how SFTP URLs work. Due to a bug, the handling of the tilde in SFTP path did however not only replace it when it is used stand-alone as the first path element but also wrongly when used as a mere prefix in the first element. Using a path like `/~2/foo` when accessing a server using the user `dan` (with home directory `/home/dan`) would then quite suprisingly access the file `/home/dan2/foo`. This can be taken advantage of to circumvent filtering or worse.(CVE-2023-27534)","status":"published","published":"2023-03-31T11:05:40Z","modified":"2026-08-18T01:17:37.702748853Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1194","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nlibcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The settings in questions are `CURLOPT_FTP_ACCOUNT`, `CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL` level.(CVE-2023-27535)\r\n\r\nlibcurl would reuse a previously created connection even when the GSS delegation (`CURLOPT_GSSAPI_DELEGATION`) option had been changed that could have changed the user\u0026apos;s permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers.(CVE-2023-27536)\r\n\r\ncurl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and \u0026quot;telnet options\u0026quot; for the server\nnegotiation. Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass on user name and telnet options to the server as provided. This could allow users to pass in carefully crafted content that pass on content or do option negotiation without the application intending to do so. In particular if an application for example allows users to provide the data or parts of the data.(CVE-2023-27533)\r\n\r\ncurl supports SFTP transfers. curl\u0026apos;s SFTP implementation offers a special feature in the path component of URLs: a tilde (`~`) character as the first\npath element in the path to denotes a path relative to the user\u0026apos;s home directory. This is supported because of wording in the [once proposed\nto-become RFC draft](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-scp-sftp-ssh-uri-04) that was to dictate how SFTP URLs work. Due to a bug, the handling of the tilde in SFTP path did however not only replace it when it is used stand-alone as the first path element but also wrongly when used as a mere prefix in the first element. Using a path like `/~2/foo` when accessing a server using the user `dan` (with home directory `/home/dan`) would then quite suprisingly access the file `/home/dan2/foo`. This can be taken advantage of to circumvent filtering or worse.(CVE-2023-27534)\n\nlibcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily.(CVE-2023-27538)","status":"published","published":"2023-03-31T11:05:40Z","modified":"2026-08-18T01:17:38.143516448Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1195","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nlibcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The settings in questions are `CURLOPT_FTP_ACCOUNT`, `CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL` level.(CVE-2023-27535)\r\n\r\nlibcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily.(CVE-2023-27538)\r\n\r\nlibcurl would reuse a previously created connection even when the GSS delegation (`CURLOPT_GSSAPI_DELEGATION`) option had been changed that could have changed the user\u0026apos;s permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers.(CVE-2023-27536)\r\n\r\ncurl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and \u0026quot;telnet options\u0026quot; for the server\nnegotiation. Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass on user name and telnet options to the server as provided. This could allow users to pass in carefully crafted content that pass on content or do option negotiation without the application intending to do so. In particular if an application for example allows users to provide the data or parts of the data.(CVE-2023-27533)\r\n\r\ncurl supports SFTP transfers. curl\u0026apos;s SFTP implementation offers a special feature in the path component of URLs: a tilde (`~`) character as the first\npath element in the path to denotes a path relative to the user\u0026apos;s home directory. This is supported because of wording in the [once proposed\nto-become RFC draft](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-scp-sftp-ssh-uri-04) that was to dictate how SFTP URLs work. Due to a bug, the handling of the tilde in SFTP path did however not only replace it when it is used stand-alone as the first path element but also wrongly when used as a mere prefix in the first element. Using a path like `/~2/foo` when accessing a server using the user `dan` (with home directory `/home/dan`) would then quite suprisingly access the file `/home/dan2/foo`. This can be taken advantage of to circumvent filtering or worse.(CVE-2023-27534)","status":"published","published":"2023-03-31T11:05:40Z","modified":"2026-08-18T01:17:37.789190268Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1196","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nlibcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The settings in questions are `CURLOPT_FTP_ACCOUNT`, `CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL` level.(CVE-2023-27535)\r\n\r\nlibcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily.(CVE-2023-27538)\r\n\r\nlibcurl would reuse a previously created connection even when the GSS delegation (`CURLOPT_GSSAPI_DELEGATION`) option had been changed that could have changed the user\u0026apos;s permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers.(CVE-2023-27536)\r\n\r\ncurl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and \u0026quot;telnet options\u0026quot; for the server\nnegotiation. Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass on user name and telnet options to the server as provided. This could allow users to pass in carefully crafted content that pass on content or do option negotiation without the application intending to do so. In particular if an application for example allows users to provide the data or parts of the data.(CVE-2023-27533)\r\n\r\ncurl supports SFTP transfers. curl\u0026apos;s SFTP implementation offers a special feature in the path component of URLs: a tilde (`~`) character as the first\npath element in the path to denotes a path relative to the user\u0026apos;s home directory. This is supported because of wording in the [once proposed\nto-become RFC draft](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-scp-sftp-ssh-uri-04) that was to dictate how SFTP URLs work. Due to a bug, the handling of the tilde in SFTP path did however not only replace it when it is used stand-alone as the first path element but also wrongly when used as a mere prefix in the first element. Using a path like `/~2/foo` when accessing a server using the user `dan` (with home directory `/home/dan`) would then quite suprisingly access the file `/home/dan2/foo`. This can be taken advantage of to circumvent filtering or worse.(CVE-2023-27534)","status":"published","published":"2023-03-31T11:05:40Z","modified":"2026-08-18T01:17:37.86362132Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:3354","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update","status":"published","published":"2024-09-14T00:03:54Z","modified":"2026-10-15T10:04:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:6679","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2024-09-16T12:25:31Z","modified":"2026-10-15T10:05:54Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2023-27533","description":"A vulnerability in input validation exists in curl \u003c8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.","status":"published","published":"2023-03-20T00:00:00Z","modified":"2026-04-22T14:04:02.849832Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2023:6679","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: GSS delegation too eager connection re-use (CVE-2023-27536)\n* curl: TELNET option IAC injection (CVE-2023-27533)\n* curl: SFTP path ~ resolving discrepancy (CVE-2023-27534)\n* curl: SSH connection too eager reuse still (CVE-2023-27538)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:34.633359798Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2023-1681490707","title":"curl: Fix of 3 CVEs","description":"- CVE-2023-27533: prevent TELNET option from IAC injection\n- CVE-2023-27535: fix behavior when FTP too eager connection reuse\n- CVE-2023-27536: do not reuse connections with different GSS delegations","status":"published","published":"2023-04-14T16:45:12Z","modified":"2026-06-01T00:33:15.829773189Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1681491163","title":"curl: Fix of 3 CVEs","description":"- CVE-2023-27533: prevent TELNET option from IAC injection\n- CVE-2023-27535: fix behavior when FTP too eager connection reuse\n- CVE-2023-27536: do not reuse connections with different GSS delegations","status":"published","published":"2023-04-14T16:52:47Z","modified":"2026-06-01T00:33:19.922475565Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1681491348","title":"Fix CVE(s): CVE-2023-27536, CVE-2023-27535, CVE-2023-27533","description":"\n   * SECURITY UPDATE: Telnet option IAC injection\n     - debian/patches/CVE-2023-27533.patch: only accept option arguments in\n       ascii to avoid embedded telnet negotiation commands\n     - CVE-2023-27533\n   * SECURITY UPDATE: FTP too eager connection reuse\n     - debian/patches/CVE-2023-27535.patch: add more conditions for connection\n       reuse\n     - CVE-2023-27535\n   * SECURITY UPDATE: GSS delegation too eager connection re-use\n     - debian/patches/CVE-2023-27536.patch: only reuse connections with same\n       GSS delegation\n     - CVE-2023-27536","status":"published","published":"2023-04-14T16:55:52Z","modified":"2026-06-04T10:03:49.829631557Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1681491543","title":"curl: Fix of 3 CVEs","description":"- CVE-2023-27533: prevent TELNET option from IAC injection\n- CVE-2023-27535: fix behavior when FTP too eager connection reuse\n- CVE-2023-27536: do not reuse connections with different GSS delegations","status":"published","published":"2023-04-14T16:59:07Z","modified":"2026-06-01T00:33:20.288521182Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1681491763","title":"curl: Fix of 3 CVEs","description":"- CVE-2023-27533: prevent TELNET option from IAC injection\n- CVE-2023-27535: fix behavior when FTP too eager connection reuse\n- CVE-2023-27536: do not reuse connections with different GSS delegations","status":"published","published":"2023-04-14T17:02:48Z","modified":"2026-06-01T00:33:21.890117701Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2026-1776847322","title":"curl: Fix of 3 CVEs","description":"- CVE-2022-27781: add limit of certificates which can be traversed breaking\n  infinite loop in NSS cert verification\n- CVE-2023-27533: prevent TELNET option from IAC injection\n- CVE-2023-27534: fix SFTP path '~' resolving discrepancy","status":"published","published":"2026-04-22T08:42:07Z","modified":"2026-06-01T00:33:14.372883496Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777463367","title":"curl: Fix of 3 CVEs","description":"- CVE-2023-27533: telnet: only accept option arguments in ascii","status":"published","published":"2026-06-29T10:23:50Z","modified":"2026-10-26T09:31:57.678556708Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777463593","title":"curl: Fix of 3 CVEs","description":"- CVE-2023-27533: telnet: only accept option arguments in ascii","status":"published","published":"2026-06-29T10:26:40Z","modified":"2026-10-26T09:31:54.496669273Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CURL-CVE-2023-27533","title":"TELNET option IAC injection","description":"curl supports communicating using the TELNET protocol and as a part of this it\noffers users to pass on username and \"telnet options\" for the server\nnegotiation.\n\nDue to lack of proper input scrubbing and without it being the documented\nfunctionality, curl would pass on username and telnet options to the server\nas provided. This could allow users to pass in carefully crafted content that\npass on content or do option negotiation without the application intending to\ndo so. In particular if an application for example allows users to provide the\ndata or parts of the data.","status":"published","published":"2023-03-20T08:00:00Z","modified":"2026-10-25T01:05:31.737544131Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"DLA-3398-1","title":"curl - security update","status":"published","published":"2023-04-21T00:00:00Z","modified":"2026-03-09T01:23:10.890398Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2023-0263","title":"Updated curl packages fix security vulnerability","description":"TELNET option IAC injection. (CVE-2023-27533)\n\nSFTP path ~ resolving discrepancy. (CVE-2023-27534)\n\nFTP too eager connection reuse. (CVE-2023-27535)\n\nGSS delegation too eager connection re-use. (CVE-2023-27536)\n\nHSTS double free. (CVE-2023-27537)\n\nSSH connection too eager reuse still. (CVE-2023-27538)\n\nUAF in SSH sha256 fingerprint check. (CVE-2023-28319)\n\nsiglongjmp race condition. (CVE-2023-28320)\n\nIDN wildcard match. (CVE-2023-28321)\n\nmore POST-after-PUT confusion. (CVE-2023-28322)\n\nHTTP headers eat all memory. (CVE-2023-38039)\n","status":"published","published":"2023-09-24T22:16:18Z","modified":"2026-04-16T04:43:47.858393758Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12812-1","title":"curl-8.0.1-1.1 on GA media","description":"These are all security issues fixed in the curl-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:14:39.607641Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:0865-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).\n- CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).\n- CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).\n- CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).\n- CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).\n","status":"published","published":"2023-03-21T17:34:18Z","modified":"2026-02-04T03:27:47.911121Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1582-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n  \n- CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).\n- CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).\n- CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).\n- CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).\n- CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).\n","status":"published","published":"2023-03-27T08:31:58Z","modified":"2026-02-04T03:43:18.30538Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1711-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).\n- CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).\n- CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).\n- CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).\n- CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).\n- CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).\n","status":"published","published":"2023-03-31T11:33:10Z","modified":"2026-02-04T03:17:02.811246Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2226-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).\n- CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).\n- CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).\n- CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).\n- CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).\n- CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).\n- CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).\n- CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).\n- CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).\n- CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).\n","status":"published","published":"2023-05-17T07:56:12Z","modified":"2026-02-04T04:40:14.720311Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2228-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).\n- CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).\n- CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).\n- CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).\n- CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).\n- CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).\n- CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).\n- CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).\n- CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).\n- CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).\n","status":"published","published":"2023-05-17T07:59:32Z","modified":"2026-02-04T03:22:09.67432Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-5964-1","title":"curl vulnerabilities","description":"Harry Sintonen discovered that curl incorrectly handled certain TELNET\nconnection options. Due to lack of proper input scrubbing, curl could pass\non user name and telnet options to the server as provided, contrary to\nexpectations. (CVE-2023-27533)\n\nHarry Sintonen discovered that curl incorrectly handled special tilde\ncharacters when used with SFTP paths. A remote attacker could possibly use\nthis issue to circumvent filtering. (CVE-2023-27534)\n\nHarry Sintonen discovered that curl incorrectly reused certain FTP\nconnections. This could lead to the wrong credentials being reused,\ncontrary to expectations. (CVE-2023-27535)\n\nHarry Sintonen discovered that curl incorrectly reused connections when the\nGSS delegation option had been changed. This could lead to the option being\nreused, contrary to expectations. (CVE-2023-27536)\n\nHarry Sintonen discovered that curl incorrectly reused certain SSH\nconnections. This could lead to the wrong credentials being reused,\ncontrary to expectations. (CVE-2023-27538)\n","status":"published","published":"2023-03-20T12:30:11Z","modified":"2026-04-22T10:33:54.377745Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-5964-2","title":"curl vulnerabilities","description":"USN-5964-1 fixed several vulnerabilities in curl. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n Harry Sintonen discovered that curl incorrectly handled certain TELNET\n connection options. Due to lack of proper input scrubbing, curl could pass\n on user name and telnet options to the server as provided, contrary to\n expectations. (CVE-2023-27533)\n\n Harry Sintonen discovered that curl incorrectly reused certain FTP\n connections. This could lead to the wrong credentials being reused,\n contrary to expectations. (CVE-2023-27535)\n\n Harry Sintonen discovered that curl incorrectly reused connections when the\n GSS delegation option had been changed. This could lead to the option being\n reused, contrary to expectations. (CVE-2023-27536)\n","status":"published","published":"2023-03-27T14:47:58Z","modified":"2026-06-29T13:50:49.875231523Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}