CVE-2023-23915
published 2023-02-23CVE-2023-23915: A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple…
PriorityP433medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.86%
54.5th percentile
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | < curl 7.88.1-1 (bookworm) | curl 7.88.1-1 (bookworm) |
| haxx | curl | >= 0 < 7.88.1-1 | 7.88.1-1 |
| haxx | curl | >= 0 < 7.88.1-1 | 7.88.1-1 |
| haxx | curl | >= 0 < 7.88.1-1 | 7.88.1-1 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.23 | 7.58.0-2ubuntu3.23 |
| haxx | curl | >= 0 < 7.68.0-1ubuntu2.16 | 7.68.0-1ubuntu2.16 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.8 | 7.81.0-1ubuntu1.8 |
| haxx | curl | >= 7.77.0 < 7.88.0 | 7.88.0 |
| https | github.com_curl_curl | — | — |
| msrc | azl3_cmake_3.21.4-10_on_azure_linux_3.0 | — | — |
| msrc | azl3_cmake_3.28.2-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.11.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_cmake_3.21.4-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_curl_7.88.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_mysql_8.0.33-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rust_1.72.0-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_tensorflow_2.11.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
osv9.1CRITICAL
vendor_ubuntu9.1CRITICAL
vendor_debian6.5MEDIUM
vendor_msrc6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
curl vulnerabilities
osv·2023-02-27·CVSS 9.1
CVE-2023-23914 [CRITICAL] curl vulnerabilities
curl vulnerabilities
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested serially. A remote attacker could possibly
use this issue to cause curl to use unencrypted connections. This issue
only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23914)
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested in parallel. A remote attacker could
possibly use this issue to cause curl to use unencrypted connections. This
issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23915)
Patrick Monnerat discovered that curl incorrectly handled memory when
processing requests with multi-header compression. A remote attacker could
possibly use this issue to cause curl to consume resources,
OSV
CVE-2023-23915: A cleartext transmission of sensitive information vulnerability exists in curl <v7
osv·2023-02-23·CVSS 6.5
CVE-2023-23915 [MEDIUM] CVE-2023-23915: A cleartext transmission of sensitive information vulnerability exists in curl <v7
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.
GHSA
GHSA-2c3h-vr56-625m: A cleartext transmission of sensitive information vulnerability exists in curl <v7
ghsa_unreviewed·2023-02-23
CVE-2023-23915 [MEDIUM] CWE-319 GHSA-2c3h-vr56-625m: A cleartext transmission of sensitive information vulnerability exists in curl <v7
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.
Ubuntu
curl vulnerabilities
vendor_ubuntu·2023-02-27·CVSS 9.1
CVE-2023-23915 [CRITICAL] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested serially. A remote attacker could possibly
use this issue to cause curl to use unencrypted connections. This issue
only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23914)
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested in parallel. A remote attacker could
possibly use this issue to cause curl to use unencrypted connections. This
issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23915)
Patrick Monnerat discovered that curl incorrectly handled memory when
processing requests with multi-header compression. A remote attacker could
Red Hat
curl: HSTS amnesia with --parallel
vendor_redhat·2023-02-15·CVSS 6.5
CVE-2023-23915 [MEDIUM] CWE-319 curl: HSTS amnesia with --parallel
curl: HSTS amnesia with --parallel
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.
A flaw was found in the Curl package, where the HSTS mechanism could fail when multiple transfers are done in parallel, as the HSTS cache file ge
Microsoft
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using it
vendor_msrc·2023-02-14·CVSS 6.5
CVE-2023-23915 [MEDIUM] CWE-319 A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using it
A cleartext transmission of sensitive information vulnerability exists in curl Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Debian
CVE-2023-23915: curl - A cleartext transmission of sensitive information vulnerability exists in curl <...
vendor_debian·2023·CVSS 6.5
CVE-2023-23915 [MEDIUM] CVE-2023-23915: curl - A cleartext transmission of sensitive information vulnerability exists in curl <...
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.
Scope: local
bookworm: resolved (fixed in 7.88.1-1)
bullseye: open
forky: resolved (fixed in 7.88.1-1)
sid: resolved (fixed in 7.88.1-1)
trixie: resolved (fixed in 7.88.1-1)
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2023-23915: HSTS amnesia with --parallel
hackerone·2023-02-24·CVSS 6.5
CVE-2023-23915 [MEDIUM] CVE-2023-23915: HSTS amnesia with --parallel
CVE-2023-23915: HSTS amnesia with --parallel
curl's HSTS cache saving behaves wrongly when multiple URLs are requested in parallel.
Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recently completed transfer.
A later HTTP-only transfer to the earlier host name would then not get upgraded properly to HSTS.
## Impact
Bypass intended security control.
CVE-2023-23915: HSTS amnesia with --parallel
Project curl Security Advisory, February 15 2023
VULNERABILITY
curl's HSTS cache saving behaves wrongly when multiple URLs are requested in paralle
HackerOne
CVE-2023-23915: HSTS amnesia with --parallel
hackerone·2023-02-15·CVSS 6.5
CVE-2023-23915 [MEDIUM] CVE-2023-23915: HSTS amnesia with --parallel
CVE-2023-23915: HSTS amnesia with --parallel
## Summary:
curl overwrites HSTS cache entries if requests are performed in parallel.
## Steps To Reproduce:
1. `curl --parallel --hsts hsts.txt https://site1.tld https://site2.tld https://site3.tld`
Only one of the sites contacted will have entry in `hsts.txt` afterwards. Non-TLS connection to the other sites will not protected by TLS.
## Impact
Request performed over insecure channels unexpectedly and loss of confidentiality and integrity.
Bugzilla
CVE-2023-23915 curl: HSTS amnesia with --parallel
bugzilla·2023-02-07·CVSS 6.5
CVE-2023-23915 [MEDIUM] CVE-2023-23915 curl: HSTS amnesia with --parallel
CVE-2023-23915 curl: HSTS amnesia with --parallel
Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recently completed transfer.
Discussion:
This CVE is public now.
https://curl.se/docs/CVE-2023-23915.html
---
Created curl tracking bugs for this issue:
Affects: fedora-all [bug 2170750]
Created mingw-curl tracking bugs for this issue:
Affects: fedora-all [bug 2170749]
---
This issue has been addressed in the following products:
JBCS httpd 2.4.51.sp2
Via RHSA-2023:3355 https://access.redhat.com/errata/RHSA-2023:3355
---
This issue ha
2023-02-23
Published