7.7
Élevée
CVE-2023-27538 An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH…
Description
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| https://github.com/curl/curl | Versions non publiées | |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
Références
- hackerone.com hackerone.com
- security.netapp.com security.netapp.com
- [debian-lts-announce] 20230421 [SECURITY] [DLA 3398-1] curl security update lists.debian.org
- GLSA-202310-12 security.gentoo.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de https://github.com/curl/curl
Les 51 CVE de https://github.com/curl/curl →
CVE-2023-28322
An information disclosure vulnerability exists in…
5.3
Moyenne
CVE-2023-28319
A use after free vulnerability exists in…
7.5
Élevée
CVE-2023-28320
A denial of service vulnerability exists in…
5.9
Moyenne
CVE-2023-28321
An improper certificate validation vulnerability exists in…
5.9
Moyenne