3.7
Faible
CVE-2021-22924 libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them…
Description
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| https://github.com/curl/curl | Versions non publiées | |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
Références
- hackerone.com hackerone.com
- FEDORA-2021-5d21b90a30 lists.fedoraproject.org
- [debian-lts-announce] 20210813 [SECURITY] [DLA 2734-1] curl security update lists.debian.org
- [kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image lists.apache.org
- [kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image lists.apache.org
- [kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image lists.apache.org
- [kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image lists.apache.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- www.oracle.com www.oracle.com
- cert-portal.siemens.com cert-portal.siemens.com
- cert-portal.siemens.com cert-portal.siemens.com
- cert-portal.siemens.com cert-portal.siemens.com
- DSA-5197 www.debian.org
- [debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update lists.debian.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de https://github.com/curl/curl
Les 51 CVE de https://github.com/curl/curl →
CVE-2023-28322
An information disclosure vulnerability exists in…
5.3
Moyenne
CVE-2023-28319
A use after free vulnerability exists in…
7.5
Élevée
CVE-2023-28320
A denial of service vulnerability exists in…
5.9
Moyenne
CVE-2023-28321
An improper certificate validation vulnerability exists in…
5.9
Moyenne