Red Hat Security Advisory

RHSA-2023:5763

curl security update

Released 2023-10-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-23.el9_2.4
Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-23.el9_2.4, curl-minimal-7.76.1-23.el9_2.4, libcurl-7.76.1-23.el9_2.4 +1

TI-2023-19922 CVE-2023-38545 · GHSA-7xw9-w465-6x42

HIGH 83

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.78689 Published 2023-10-18 Fixed in 8.4.0, 7.69.0 CWE-787

TI-2023-19923 CVE-2023-38546 · GHSA-x3qx-m3c2-qfhx

LOW 27

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.05956 Published 2023-10-18 Partial fix · 8.4.0, 7.9.1