CVE-2023-27538
published 2023-03-30CVE-2023-27538: An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH…
PriorityP429medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
1.16%
63.6th percentile
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | < curl 7.88.1-7 (bookworm) | curl 7.88.1-7 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| haxx | curl | >= 0 < 7.74.0-1.3+deb11u8 | 7.74.0-1.3+deb11u8 |
| haxx | curl | >= 0 < 7.88.1-7 | 7.88.1-7 |
| haxx | curl | >= 0 < 7.88.1-7 | 7.88.1-7 |
| haxx | curl | >= 0 < 7.88.1-7 | 7.88.1-7 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.24 | 7.58.0-2ubuntu3.24 |
| haxx | curl | >= 0 < 7.68.0-1ubuntu2.18 | 7.68.0-1ubuntu2.18 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.10 | 7.81.0-1ubuntu1.10 |
| haxx | libcurl | >= 7.16.1 < 8.0.0 | 8.0.0 |
| https | github.com_curl_curl | — | — |
| msrc | azl3_cmake_3.21.4-10_on_azure_linux_3.0 | — | — |
| msrc | azl3_cmake_3.28.2-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.11.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_cmake_3.21.4-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_curl_8.0.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_mysql_8.0.34-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rust_1.72.0-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_tensorflow_2.11.1-2_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-02-15
Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-15
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Out-of-bounds Read, Inadequate Encryption Strength, Double Free, Use After Free, NULL Pointer Dereference, Improper Input Validation, Missing Encryption of Sensitive Data, Allocation of Resources Wit
CISA ICS
Siemens SINEC INS
cisa_ics·2023-12-14·CVSS 7.5
[HIGH] Siemens SINEC INS
ICS Advisory
##
Siemens SINEC INS
Release DateDecember 14, 2023
Alert CodeICSA-23-348-16
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerabilities: Improper Certificate Validation, Improper Input Validation, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Unexpected Status Code or Return Value, Missing
Ubuntu
curl vulnerabilities
vendor_ubuntu·2023-03-20·CVSS 8.8
CVE-2023-27533 [HIGH] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Harry Sintonen discovered that curl incorrectly handled certain TELNET
connection options. Due to lack of proper input scrubbing, curl could pass
on user name and telnet options to the server as provided, contrary to
expectations. (CVE-2023-27533)
Harry Sintonen discovered that curl incorrectly handled special tilde
characters when used with SFTP paths. A remote attacker could possibly use
this issue to circumvent filtering. (CVE-2023-27534)
Harry Sintonen discovered that curl incorrectly reused certain FTP
connections. This could lead to the wrong credentials being reused,
contrary to expectations. (CVE-2023-27535)
Harry Sintonen discovered that curl incorrectly reused connections when the
GSS delegation
Red Hat
curl: SSH connection too eager reuse still
vendor_redhat·2023-03-20·CVSS 5.5
CVE-2023-27538 [MEDIUM] CWE-305 curl: SSH connection too eager reuse still
curl: SSH connection too eager reuse still
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.
Package: rh-dotnet31-curl (.NET Core 3.1 on Red Hat Enterprise Linux) - Out of support scope
Package: curl (Red Hat Enterprise Linux 6) - Out of support scope
Package: curl (Red Hat Enterprise Linux 7) - Will not fix
Package: curl (Red Hat Enterpris
Microsoft
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified which should have prev
vendor_msrc·2023-03-14·CVSS 5.5
CVE-2023-27538 [MEDIUM] CWE-287 An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified which should have prev
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However two SSH settings were omitted from the configuration check allowing them to match easily potentially leading to the reuse of an inappropriate connection.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most
Debian
CVE-2023-27538: curl - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where i...
vendor_debian·2023·CVSS 5.5
CVE-2023-27538 [MEDIUM] CVE-2023-27538: curl - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where i...
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.
Scope: local
bookworm: resolved (fixed in 7.88.1-7)
bullseye: resolved (fixed in 7.74.0-1.3+deb11u8)
forky: resolved (fixed in 7.88.1-7)
sid: resolved (fixed in 7.88.1-7)
trixie: resolved (fixed in 7.88.1-7)
OSV
CVE-2023-27538: An authentication bypass vulnerability exists in libcurl prior to v8
osv·2023-03-30·CVSS 5.5
CVE-2023-27538 [MEDIUM] CVE-2023-27538: An authentication bypass vulnerability exists in libcurl prior to v8
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.
GHSA
GHSA-cgj3-cvg6-pcvh: An authentication bypass vulnerability exists in libcurl v8
ghsa_unreviewed·2023-03-30
CVE-2023-27538 [MEDIUM] CWE-287 GHSA-cgj3-cvg6-pcvh: An authentication bypass vulnerability exists in libcurl v8
An authentication bypass vulnerability exists in libcurl v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.
OSV
curl vulnerabilities
osv·2023-03-20·CVSS 8.8
CVE-2023-27533 [HIGH] curl vulnerabilities
curl vulnerabilities
Harry Sintonen discovered that curl incorrectly handled certain TELNET
connection options. Due to lack of proper input scrubbing, curl could pass
on user name and telnet options to the server as provided, contrary to
expectations. (CVE-2023-27533)
Harry Sintonen discovered that curl incorrectly handled special tilde
characters when used with SFTP paths. A remote attacker could possibly use
this issue to circumvent filtering. (CVE-2023-27534)
Harry Sintonen discovered that curl incorrectly reused certain FTP
connections. This could lead to the wrong credentials being reused,
contrary to expectations. (CVE-2023-27535)
Harry Sintonen discovered that curl incorrectly reused connections when the
GSS delegation option had been changed. This could lead to the option being
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2023-27538: SSH connection too eager reuse still
hackerone·2023-04-19·CVSS 5.5
CVE-2023-27538 [MEDIUM] CVE-2023-27538: SSH connection too eager reuse still
CVE-2023-27538: SSH connection too eager reuse still
libcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse.
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily.
## Hackerone report
#1898475
## Impact
Connection reuse when different ssh keys are specified.
libcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse.
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. Howe
HackerOne
CVE-2023-27538: SSH connection too eager reuse still
hackerone·2023-03-22·CVSS 5.5
CVE-2023-27538 [MEDIUM] CVE-2023-27538: SSH connection too eager reuse still
CVE-2023-27538: SSH connection too eager reuse still
## Summary:
There's a check if SSH keys match between new and existing connection when considering reuse. This check is broken due to wrong comparison:
`#define PROTO_FAMILY_SSH (CURLPROTO_SCP|CURLPROTO_SFTP)`
...
`else if(get_protocol_family(needle->handler) == PROTO_FAMILY_SSH) {`
This never matches as handler family is either `CURLPROTO_SCP` or `CURLPROTO_SFTP`.
## Remediation
* Make the code:
`else if(get_protocol_family(needle->handler) & PROTO_FAMILY_SSH) {`
## Steps To Reproduce:
1. Make two connections to the same host with different ssh keys
## Impact
Connection reuse when different ssh keys are used.
https://hackerone.com/reports/1898475https://lists.debian.org/debian-lts-announce/2023/04/msg00025.htmlhttps://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230420-0010/https://hackerone.com/reports/1898475https://lists.debian.org/debian-lts-announce/2023/04/msg00025.htmlhttps://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230420-0010/
2023-03-30
Published