Read the docs
Red Hat Security Advisory

RHSA-2023:6679

curl security update

Released 2023-11-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 4 records

TI-2023-12257 CVE-2023-27533 · GHSA-xvw3-6q4f-2gcv

Injection in https://github.com/curl/curl

Priority HIGH 82

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02156 Published 2023-03-30 Fixed CWE-75
TI-2023-12258 CVE-2023-27534 · GHSA-4j25-c9rf-fp5f

Path traversal in https://github.com/curl/curl

Priority HIGH 73

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0244 Published 2023-03-30 Partial fix CWE-22
TI-2023-12260 CVE-2023-27536 · GHSA-4f9f-mpmj-4c52

Authentication bypass in https://github.com/curl/curl

Priority MEDIUM 60

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01758 Published 2023-03-30 Partial fix CWE-305
TI-2023-12262 CVE-2023-27538 · GHSA-cgj3-cvg6-pcvh

Authentication bypass in https://github.com/curl/curl

Priority LOW 37

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse.

CVSS 3.1HIGH 7.7 Local No auth No interaction EPSS 0.01451 Published 2023-03-30 Partial fix CWE-305