Medium severity · published Mar 30, 2023
CVE-2023-27537
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles"
5.9
CVSS
1.9%
EPSS
No
On KEV
Description
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
https://github.com/curl/curl ·
Fixed in 8.0.0 · source: vendor
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
BF
Brocade Fabric Operating System Firmware · Broadcom
All versions, or not specified · source: NVD
CD
Clustered Data Ontap · Netapp
9.0 · source: NVD
HF
H300s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H410s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H500s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H700s Firmware · Netapp
All versions, or not specified · source: NVD
LI
Libcurl · Haxx
7.88.0; 7.88.1 · source: NVD
UF
Universal Forwarder · Splunk
8.2.0 before 8.2.12; 9.0.0 before 9.0.6; 9.1.0 · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27537
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27537
Exploit
https://hackerone.com/reports/1897203
Third Party Advisory
https://security.gentoo.org/glsa/202310-12
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230420-0010/
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-943925.html
More from https://github.com/curl/curl
9.8
CVE-2022-32221
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been…
9.8
CVE-2022-32207
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final…
9.1
CVE-2023-23914
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially
9.1
CVE-2021-22945
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in…
8.8
CVE-2023-27534
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in…