CVE-2023-23914
published 2023-02-23CVE-2023-23914: A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are…
PriorityP345critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.86%
56.7th percentile
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | < curl 7.88.1-1 (bookworm) | curl 7.88.1-1 (bookworm) |
| haxx | curl | >= 0 < 7.88.1-1 | 7.88.1-1 |
| haxx | curl | >= 0 < 7.88.1-1 | 7.88.1-1 |
| haxx | curl | >= 0 < 7.88.1-1 | 7.88.1-1 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.23 | 7.58.0-2ubuntu3.23 |
| haxx | curl | >= 0 < 7.68.0-1ubuntu2.16 | 7.68.0-1ubuntu2.16 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.8 | 7.81.0-1ubuntu1.8 |
| haxx | curl | >= 7.77.0 < 7.88.0 | 7.88.0 |
| https | github.com_curl_curl | — | — |
| msrc | azl3_cmake_3.21.4-10_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.11.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_cmake_3.21.4-6_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_curl_7.88.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_mysql_8.0.32-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rust_1.68.2-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_tensorflow_2.11.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_msrc9.1CRITICAL
vendor_oracle9.1CRITICAL
vendor_redhat9.1CRITICAL
vendor_ubuntu9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Networking (curl) — CVE-2023-23914
vendor_oracle·2023-10-15·CVSS 9.1
CVE-2023-23914 [CRITICAL] Oracle Oracle Enterprise Manager Risk Matrix: Networking (curl) — CVE-2023-23914
Oracle Oracle Enterprise Manager Risk Matrix: Networking (curl) vulnerability
CVE: CVE-2023-23914
CVSS: 9.1
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (cURL) — CVE-2023-23914
vendor_oracle·2023-07-15·CVSS 9.1
CVE-2023-23914 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (cURL) — CVE-2023-23914
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (cURL) vulnerability
CVE: CVE-2023-23914
CVSS: 9.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Oracle
Oracle Oracle HealthCare Applications Risk Matrix: DataStudio (cURL) — CVE-2023-23914
vendor_oracle·2023-04-15·CVSS 9.1
CVE-2023-23914 [CRITICAL] Oracle Oracle HealthCare Applications Risk Matrix: DataStudio (cURL) — CVE-2023-23914
Oracle Oracle HealthCare Applications Risk Matrix: DataStudio (cURL) vulnerability
CVE: CVE-2023-23914
CVSS: 9.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Ubuntu
curl vulnerabilities
vendor_ubuntu·2023-02-27·CVSS 9.1
CVE-2023-23915 [CRITICAL] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested serially. A remote attacker could possibly
use this issue to cause curl to use unencrypted connections. This issue
only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23914)
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested in parallel. A remote attacker could
possibly use this issue to cause curl to use unencrypted connections. This
issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23915)
Patrick Monnerat discovered that curl incorrectly handled memory when
processing requests with multi-header compression. A remote attacker could
Red Hat
curl: HSTS ignored on multiple requests
vendor_redhat·2023-02-15·CVSS 9.1
CVE-2023-23914 [CRITICAL] CWE-319 curl: HSTS ignored on multiple requests
curl: HSTS ignored on multiple requests
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.
A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This issue may result in limited confidentiality and integrity.
Statement: This is
Microsoft
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support curl
vendor_msrc·2023-02-14·CVSS 9.1
CVE-2023-23914 [CRITICAL] CWE-319 A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support curl
A cleartext transmission of sensitive information vulnerability exists in curl Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Debian
CVE-2023-23914: curl - A cleartext transmission of sensitive information vulnerability exists in curl <...
vendor_debian·2023·CVSS 9.1
CVE-2023-23914 [CRITICAL] CVE-2023-23914: curl - A cleartext transmission of sensitive information vulnerability exists in curl <...
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.
Scope: local
bookworm: resolved (fixed in 7.88.1-1)
bullseye: open
forky: resolved (fixed in 7.88.1-1)
sid: resolved (fixed in 7.88.1-1)
trixie: resolved (fixed in 7.88.1-1)
OSV
curl vulnerabilities
osv·2023-02-27·CVSS 9.1
CVE-2023-23914 [CRITICAL] curl vulnerabilities
curl vulnerabilities
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested serially. A remote attacker could possibly
use this issue to cause curl to use unencrypted connections. This issue
only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23914)
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested in parallel. A remote attacker could
possibly use this issue to cause curl to use unencrypted connections. This
issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23915)
Patrick Monnerat discovered that curl incorrectly handled memory when
processing requests with multi-header compression. A remote attacker could
possibly use this issue to cause curl to consume resources,
OSV
CVE-2023-23914: A cleartext transmission of sensitive information vulnerability exists in curl <v7
osv·2023-02-23·CVSS 9.1
CVE-2023-23914 [CRITICAL] CVE-2023-23914: A cleartext transmission of sensitive information vulnerability exists in curl <v7
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.
GHSA
GHSA-75qm-2q4j-qx6g: A cleartext transmission of sensitive information vulnerability exists in curl <v7
ghsa_unreviewed·2023-02-23
CVE-2023-23914 GHSA-75qm-2q4j-qx6g: A cleartext transmission of sensitive information vulnerability exists in curl <v7
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2023-23915: HSTS amnesia with --parallel
hackerone·2023-02-24·CVSS 6.5
CVE-2023-23915 [MEDIUM] CVE-2023-23915: HSTS amnesia with --parallel
CVE-2023-23915: HSTS amnesia with --parallel
curl's HSTS cache saving behaves wrongly when multiple URLs are requested in parallel.
Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recently completed transfer.
A later HTTP-only transfer to the earlier host name would then not get upgraded properly to HSTS.
## Impact
Bypass intended security control.
CVE-2023-23915: HSTS amnesia with --parallel
Project curl Security Advisory, February 15 2023
VULNERABILITY
curl's HSTS cache saving behaves wrongly when multiple URLs are requested in paralle
HackerOne
CVE-2023-23914: HSTS ignored on multiple requests
hackerone·2023-02-24·CVSS 9.1
CVE-2023-23914 [CRITICAL] CVE-2023-23914: HSTS ignored on multiple requests
CVE-2023-23914: HSTS ignored on multiple requests
curl's HSTS functionality fail when multiple URLs are requested serially.
Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however suprisingly be ignored by subsequent transfers when done on the same command line because the state would not be properly carried on.
## Impact
Bypass intended security control.
CVE-2023-23914: HSTS ignored on multiple requests
Project curl Security Advisory, February 15 2023
VULNERABILITY
curl's HSTS functionality fail when multiple URLs are requested serially.
Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when H
HackerOne
CVE-2023-23914: curl HSTS ignored on multiple requests
hackerone·2023-02-15·CVSS 9.1
CVE-2023-23914 [CRITICAL] CVE-2023-23914: curl HSTS ignored on multiple requests
CVE-2023-23914: curl HSTS ignored on multiple requests
## Summary:
curl tool HSTS doesn't work correctly when performing multiple requests within a single invocation.
## Steps To Reproduce:
1. `curl --hsts "" https://hsts.example.com http://hsts.example.com`
The second request will be performed over HTTP regardless if correct HSTS header is returned by the first request.
## Impact
Request performed over insecure channels unexpectedly and loss of confidentiality and integrity.
2023-02-23
Published