Skip to content
fr Sign in
Not rated

CVE-2023-38546 This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of…

Description

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Affected products and versions

Product Affected versions Fixed in
curl 8.4 earliest → < 8.4.0 8.4.0
curl 7.9 earliest → < 7.9.1 7.9.1
RUGGEDCOM APE1808 Versions not published
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.5 → latest No fix stated
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 3.1.5 → latest No fix stated
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.5 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of curl

The 98 CVEs of curl →
CVE-2026-107929 When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes… 8.1 High CVE-2026-107928 When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer 8.1 High CVE-2026-94266 libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing… 7.5 High CVE-2026-94265 When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might… 9.1 Critical
Track this CVE