CVE-2023-28319
published 2023-05-26CVE-2023-28319: A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
2.49%
84.0th percentile
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | >= 11.0 < 11.7.9 | 11.7.9 |
| apple | macos | >= 12.0 < 12.6.8 | 12.6.8 |
| apple | macos | >= 13.0 < 13.5 | 13.5 |
| apple | macos_big_sur | — | — |
| apple | macos_monterey | — | — |
| apple | macos_ventura | — | — |
| debian | curl | < curl 7.88.1-10 (bookworm) | curl 7.88.1-10 (bookworm) |
| haxx | curl | < 8.1.0 | 8.1.0 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| https | github.com_curl_curl | — | — |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.11.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_curl_8.2.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_mysql_8.0.34-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rust_1.72.0-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_tensorflow_2.11.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-02-15
Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-15
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Out-of-bounds Read, Inadequate Encryption Strength, Double Free, Use After Free, NULL Pointer Dereference, Improper Input Validation, Missing Encryption of Sensitive Data, Allocation of Resources Wit
Apple
CVE-2023-28319: macOS Monterey 12.6.8
vendor_apple·2023-07-24·CVSS 7.5
CVE-2023-28319 [HIGH] CVE-2023-28319: macOS Monterey 12.6.8
Apple Security Update: About the security content of macOS Monterey 12.6.8
Product: macOS Monterey
Version: 12.6.8
CVE: CVE-2023-28319
Component: CVE-2023-28319
Apple
CVE-2023-28319: macOS Ventura 13.5
vendor_apple·2023-07-24·CVSS 7.5
CVE-2023-28319 [HIGH] CVE-2023-28319: macOS Ventura 13.5
Apple Security Update: About the security content of macOS Ventura 13.5
Product: macOS Ventura
Version: 13.5
CVE: CVE-2023-28319
Component: CVE-2023-28319
Apple
CVE-2023-28319: macOS Big Sur 11.7.9
vendor_apple·2023-07-24·CVSS 7.5
CVE-2023-28319 [HIGH] CVE-2023-28319: macOS Big Sur 11.7.9
Apple Security Update: About the security content of macOS Big Sur 11.7.9
Product: macOS Big Sur
Version: 11.7.9
CVE: CVE-2023-28319
Component: CVE-2023-28319
Red Hat
curl: use after free in SSH sha256 fingerprint check
vendor_redhat·2023-05-17·CVSS 7.5
CVE-2023-28319 [HIGH] CWE-416 curl: use after free in SSH sha256 fingerprint check
curl: use after free in SSH sha256 fingerprint check
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
A use-after-free flaw was found in the Curl package. This flaw risks inserting sensitive heap-based data into the error message that users might see or is otherwise leaked and revealed.
Statement: This vulnerability does not affect the Curl package as shipped in Red Hat Enterprise Linux 6, 7, 8 and 9.
Package:
Microsoft
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails libcurl would free the memory
vendor_msrc·2023-05-09·CVSS 7.5
CVE-2023-28319 [HIGH] CWE-416 A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails libcurl would free the memory
A use after free vulnerability exists in curl Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microso
Debian
CVE-2023-28319: curl - A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers ...
vendor_debian·2023·CVSS 7.5
CVE-2023-28319 [HIGH] CVE-2023-28319: curl - A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers ...
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
Scope: local
bookworm: resolved (fixed in 7.88.1-10)
bullseye: resolved
forky: resolved (fixed in 7.88.1-10)
sid: resolved (fixed in 7.88.1-10)
trixie: resolved (fixed in 7.88.1-10)
GHSA
GHSA-6xq7-qqp2-9mmc: A use after free vulnerability exists in curl <v8
ghsa_unreviewed·2023-05-26
CVE-2023-28319 [HIGH] CWE-416 GHSA-6xq7-qqp2-9mmc: A use after free vulnerability exists in curl <v8
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
OSV
CVE-2023-28319: A use after free vulnerability exists in curl <v8
osv·2023-05-26·CVSS 7.5
CVE-2023-28319 [HIGH] CVE-2023-28319: A use after free vulnerability exists in curl <v8
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2023-28319: UAF in SSH sha256 fingerprint check
hackerone·2023-06-25·CVSS 7.5
CVE-2023-28319 [HIGH] CVE-2023-28319: UAF in SSH sha256 fingerprint check
CVE-2023-28319: UAF in SSH sha256 fingerprint check
libcurl offers a feature to verify an SSH server's public key using a SHA 256
hash. When this check fails, libcurl would free the memory for the fingerprint
before it returns an error message containing the (now freed) hash.
Affected versions: curl 7.81.0 to and including 8.0.1
Not affected versions: curl = 8.1.0
The original submission can be found here: https://hackerone.com/reports/1913733
## Impact
This flaw risks inserting sensitive heap-based data into the error message
that might be shown to users or otherwise get leaked and revealed.
CVE-2023-28319 - UAF in SSH sha256 fingerprint check
VULNERABILITY
libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free
HackerOne
CVE-2023-28319: UAF in SSH sha256 fingerprint check
hackerone·2023-05-24·CVSS 7.5
CVE-2023-28319 [HIGH] CVE-2023-28319: UAF in SSH sha256 fingerprint check
CVE-2023-28319: UAF in SSH sha256 fingerprint check
## Summary:
The fingerprint_b64 pointer is as parameter for failure logging after it is freed.
## Steps To Reproduce:
1. git clone https://github.com/curl/curl
2. vim curl/lib/vssh/libssh2.c
3. search for the string 'free(fingerprint_b64)' and note that fingerprint_b64 is used as parameter immediately after it is freed.
## Supporting Material/References:
The following are the details of the code.
git commit a51f90ec0f74176776f5d14b99689f9241660eaa (HEAD -> master, origin/master, origin/HEAD)
In curl/lib/vssh/libssh2.c
653 static CURLcode ssh_check_fingerprint(struct Curl_easy *data)
654 {
...
667 char *fingerprint_b64 = NULL;
...
729 if((pub_pos != b64_pos) ||
730 strncmp(fingerprint_b64, pubkey_sha256, pub_pos)) {
731 free(fingerpri
http://seclists.org/fulldisclosure/2023/Jul/47http://seclists.org/fulldisclosure/2023/Jul/48http://seclists.org/fulldisclosure/2023/Jul/52https://hackerone.com/reports/1913733https://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230609-0009/https://support.apple.com/kb/HT213843https://support.apple.com/kb/HT213844https://support.apple.com/kb/HT213845http://seclists.org/fulldisclosure/2023/Jul/47http://seclists.org/fulldisclosure/2023/Jul/48http://seclists.org/fulldisclosure/2023/Jul/52https://hackerone.com/reports/1913733https://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230609-0009/https://support.apple.com/kb/HT213843https://support.apple.com/kb/HT213844https://support.apple.com/kb/HT213845
2023-05-26
Published