CVE-2023-28320
published 2023-05-26CVE-2023-28320: A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build…
PriorityP429medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
2.66%
83.7th percentile
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | >= 11.0 < 11.7.9 | 11.7.9 |
| apple | macos | >= 12.0 < 12.6.8 | 12.6.8 |
| apple | macos | >= 13.0 < 13.5 | 13.5 |
| apple | macos_big_sur | — | — |
| apple | macos_monterey | — | — |
| apple | macos_ventura | — | — |
| debian | curl | < curl 7.88.1-10 (bookworm) | curl 7.88.1-10 (bookworm) |
| haxx | curl | < 8.1.0 | 8.1.0 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| https | github.com_curl_curl | — | — |
| msrc | azl3_cmake_3.21.4-10_on_azure_linux_3.0 | — | — |
| msrc | azl3_cmake_3.28.2-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.11.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_cmake_3.21.4-11_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_curl_8.2.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_mysql_8.0.34-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rust_1.72.0-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_tensorflow_2.11.1-2_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv5.9MEDIUM
vendor_debian5.9LOW
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-02-15
Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-15
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Out-of-bounds Read, Inadequate Encryption Strength, Double Free, Use After Free, NULL Pointer Dereference, Improper Input Validation, Missing Encryption of Sensitive Data, Allocation of Resources Wit
Apple
CVE-2023-28320: macOS Big Sur 11.7.9
vendor_apple·2023-07-24·CVSS 5.9
CVE-2023-28320 [MEDIUM] CVE-2023-28320: macOS Big Sur 11.7.9
Apple Security Update: About the security content of macOS Big Sur 11.7.9
Product: macOS Big Sur
Version: 11.7.9
CVE: CVE-2023-28320
Component: CVE-2023-28320
Apple
CVE-2023-28320: macOS Ventura 13.5
vendor_apple·2023-07-24·CVSS 5.9
CVE-2023-28320 [MEDIUM] CVE-2023-28320: macOS Ventura 13.5
Apple Security Update: About the security content of macOS Ventura 13.5
Product: macOS Ventura
Version: 13.5
CVE: CVE-2023-28320
Component: CVE-2023-28320
Apple
CVE-2023-28320: macOS Monterey 12.6.8
vendor_apple·2023-07-24·CVSS 5.9
CVE-2023-28320 [MEDIUM] CVE-2023-28320: macOS Monterey 12.6.8
Apple Security Update: About the security content of macOS Monterey 12.6.8
Product: macOS Monterey
Version: 12.6.8
CVE: CVE-2023-28320
Component: CVE-2023-28320
Red Hat
curl: siglongjmp race condition may lead to crash
vendor_redhat·2023-05-17·CVSS 5.9
CVE-2023-28320 [MEDIUM] CWE-662 curl: siglongjmp race condition may lead to crash
curl: siglongjmp race condition may lead to crash
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
Statement: This vulnerability does not affect versions of the curl package as shipped with Red Hat Enterprise Linux 6,7,8 and 9.
Package: rh-dotnet31-curl (.NET Core 3.1 on Red Hat Enterprise Linux) - Out of support scope
Package: curl (Red Hat Enterprise Linux 6) - Out of support scope
Packa
Microsoft
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names selected at build time. If it is built to use the synchronous r
vendor_msrc·2023-05-09·CVSS 5.9
CVE-2023-28320 [MEDIUM] CWE-362 A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names selected at build time. If it is built to use the synchronous r
A denial of service vulnerability exists in curl Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.micr
Debian
CVE-2023-28320: curl - A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl prov...
vendor_debian·2023·CVSS 5.9
CVE-2023-28320 [MEDIUM] CVE-2023-28320: curl - A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl prov...
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
Scope: local
bookworm: resolved (fixed in 7.88.1-10)
bullseye: open
forky: resolved (fixed in 7.88.1-10)
sid: resolved (fixed in 7.88.1-10)
trixie: resolved (fixed in 7.88.1-10)
OSV
CVE-2023-28320: A denial of service vulnerability exists in curl <v8
osv·2023-05-26·CVSS 5.9
CVE-2023-28320 [MEDIUM] CVE-2023-28320: A denial of service vulnerability exists in curl <v8
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
GHSA
GHSA-c8wj-435x-f2cc: A denial of service vulnerability exists in curl <v8
ghsa_unreviewed·2023-05-26
CVE-2023-28320 [MEDIUM] CWE-362 GHSA-c8wj-435x-f2cc: A denial of service vulnerability exists in curl <v8
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2023-28320 - siglongjmp race condition
hackerone·2023-05-26·CVSS 5.9
CVE-2023-28320 [MEDIUM] CVE-2023-28320 - siglongjmp race condition
CVE-2023-28320 - siglongjmp race condition
libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp().
When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
## Impact
Denial of service due to a crash (likely) or possibly other impacts.
HackerOne
CVE-2023-28320: siglongjmp race condition
hackerone·2023-05-17·CVSS 5.9
CVE-2023-28320 [MEDIUM] CVE-2023-28320: siglongjmp race condition
CVE-2023-28320: siglongjmp race condition
## Summary:
If the system has no POSIX or Windows threading support, `USE_ALARM_TIMEOUT` codepath will be used in `lib/hostip.c`. If two threads will perform DNS resolving, a wrong register context can be used on the signal handler`siglongjmp` call if DNS timeout occurs. Typically this results in segmentation fault, but depending on platform specifics other impacts might be possible (but unlikely).
The documentation warns against this very issue in https://curl.se/libcurl/c/threadsafe.html `It is important that libcurl can find and use thread safe versions of these and other system calls, as otherwise it cannot function fully thread safe.` The issue is that there is no way for the application using libcurl to know if the library is MT safe for DN
http://seclists.org/fulldisclosure/2023/Jul/47http://seclists.org/fulldisclosure/2023/Jul/48http://seclists.org/fulldisclosure/2023/Jul/52https://hackerone.com/reports/1929597https://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230609-0009/https://support.apple.com/kb/HT213843https://support.apple.com/kb/HT213844https://support.apple.com/kb/HT213845http://seclists.org/fulldisclosure/2023/Jul/47http://seclists.org/fulldisclosure/2023/Jul/48http://seclists.org/fulldisclosure/2023/Jul/52https://hackerone.com/reports/1929597https://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230609-0009/https://support.apple.com/kb/HT213843https://support.apple.com/kb/HT213844https://support.apple.com/kb/HT213845
2023-05-26
Published