RHSA-2023:7626

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow.

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c.

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field.

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints.

Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not…

Issue summary: Checking excessively long DH keys or parameters may be very slow.

Issue summary: Checking excessively long DH keys or parameters may be very slow.

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately.

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification.

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.