CVE-2023-27535

Severity
5.9MEDIUM
EPSS
0.1%
top 79.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 30

Description

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages4 packages

NVDhaxx/libcurl7.13.07.88.1
NVDsplunk/universal_forwarder8.2.08.2.12+2
Debiancurl< 7.74.0-1.3+deb11u8+3
CVEListV5https://github.com/curl/curlFixed in 8.0.0

Also affects: Debian Linux 10.0, Fedora 36

🔴Vulnerability Details

5
OSV
CVE-2023-27535: An authentication bypass vulnerability exists in libcurl <82023-03-30
GHSA
GHSA-q9fm-68jc-87x3: An authentication bypass vulnerability exists in libcurl <82023-03-30
CVEList
CVE-2023-27535: An authentication bypass vulnerability exists in libcurl <82023-03-30
OSV
curl vulnerabilities2023-03-27
OSV
curl vulnerabilities2023-03-20

📋Vendor Advisories

5
Ubuntu
curl vulnerabilities2023-03-27
Red Hat
curl: FTP too eager connection reuse2023-03-20
Ubuntu
curl vulnerabilities2023-03-20
Microsoft
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created conn2023-03-14
Debian
CVE-2023-27535: curl - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP conne...2023

💬Community

2
HackerOne
CVE-2023-27535: FTP too eager connection reuse2023-03-22
HackerOne
CVE-2023-27535: FTP too eager connection reuse2023-03-20