111 lines
3.4 KiB
JSON
111 lines
3.4 KiB
JSON
{
|
|
"schema_version": "1.6.3",
|
|
"id": "USN-6429-3",
|
|
"summary": "curl vulnerabilities",
|
|
"details": "USN-6429-1 fixed vulnerabilities in curl. This update provides the\ncorresponding updates for Ubuntu 23.10.\n\nOriginal advisory details:\n\n Jay Satiro discovered that curl incorrectly handled hostnames when using a\n SOCKS5 proxy. In environments where curl is configured to use a SOCKS5\n proxy, a remote attacker could possibly use this issue to execute arbitrary\n code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04.\n (CVE-2023-38545)\n \n It was discovered that curl incorrectly handled cookies when an application\n duplicated certain handles. A local attacker could possibly create a cookie\n file and inject arbitrary cookies into subsequent connections.\n (CVE-2023-38546)\n",
|
|
"aliases": [],
|
|
"related": [
|
|
"CVE-2023-38545",
|
|
"UBUNTU-CVE-2023-38545",
|
|
"CVE-2023-38546",
|
|
"UBUNTU-CVE-2023-38546"
|
|
],
|
|
"published": "2023-10-17T11:22:48.353678Z",
|
|
"modified": "2023-10-17T11:22:48.353678Z",
|
|
"affected": [
|
|
{
|
|
"package": {
|
|
"ecosystem": "Ubuntu:23.10",
|
|
"name": "curl",
|
|
"purl": "pkg:deb/ubuntu/curl@8.2.1-1ubuntu3.1?arch=source&distro=mantic"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{
|
|
"introduced": "0"
|
|
},
|
|
{
|
|
"fixed": "8.2.1-1ubuntu3.1"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"versions": [
|
|
"7.88.1-8ubuntu1",
|
|
"7.88.1-9ubuntu1",
|
|
"7.88.1-10ubuntu1",
|
|
"8.2.1-1ubuntu2",
|
|
"8.2.1-1ubuntu3"
|
|
],
|
|
"ecosystem_specific": {
|
|
"binaries": [
|
|
{
|
|
"binary_name": "curl",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "curl-dbgsym",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "libcurl3-gnutls",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "libcurl3-gnutls-dbgsym",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "libcurl3-nss",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "libcurl3-nss-dbgsym",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "libcurl4",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "libcurl4-dbgsym",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "libcurl4-doc",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "libcurl4-gnutls-dev",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "libcurl4-nss-dev",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
},
|
|
{
|
|
"binary_name": "libcurl4-openssl-dev",
|
|
"binary_version": "8.2.1-1ubuntu3.1"
|
|
}
|
|
],
|
|
"availability": "No subscription required"
|
|
}
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"type": "ADVISORY",
|
|
"url": "https://ubuntu.com/security/notices/USN-6429-3"
|
|
},
|
|
{
|
|
"type": "REPORT",
|
|
"url": "https://ubuntu.com/security/CVE-2023-38545"
|
|
},
|
|
{
|
|
"type": "REPORT",
|
|
"url": "https://ubuntu.com/security/CVE-2023-38546"
|
|
}
|
|
]
|
|
} |