CVE-2023-28322
published 2023-05-26CVE-2023-28322: An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback…
PriorityP417low3.7CVSS 3.1
AVNACHPRNUINSUCLINAN
EPSS
2.21%
81.3th percentile
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | >= 11.0 < 11.7.9 | 11.7.9 |
| apple | macos | >= 12.0 < 12.6.8 | 12.6.8 |
| apple | macos | >= 13.0 < 13.5 | 13.5 |
| apple | macos_big_sur | — | — |
| apple | macos_monterey | — | — |
| apple | macos_ventura | — | — |
| debian | curl | < curl 7.88.1-10 (bookworm) | curl 7.88.1-10 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| haxx | curl | < 8.1.0 | 8.1.0 |
| haxx | curl | >= 0 < 7.74.0-1.3+deb11u9 | 7.74.0-1.3+deb11u9 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| haxx | curl | >= 0 < 7.68.0-1ubuntu2.19 | 7.68.0-1ubuntu2.19 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.13 | 7.81.0-1ubuntu1.13 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.11 | 7.81.0-1ubuntu1.11 |
| haxx | curl | >= 0 < 7.35.0-1ubuntu2.20+esm16 | 7.35.0-1ubuntu2.20+esm16 |
| haxx | curl | >= 0 < 7.47.0-1ubuntu2.19+esm9 | 7.47.0-1ubuntu2.19+esm9 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.24+esm1 | 7.58.0-2ubuntu3.24+esm1 |
| https | github.com_curl_curl | — | — |
| msrc | azl3_cmake_3.21.4-10_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.11.1-1_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
osv5.9MEDIUM
vendor_ubuntu5.9MEDIUM
vendor_debian3.7LOW
vendor_msrc3.7LOW
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2025-0012 Informational Bulletin: OSS CVEs Fixed in PAN-OS
vendor_paloalto·2025-07-09·CVSS 7.5
CVE-2018-6594 [HIGH] PAN-SA-2025-0012 Informational Bulletin: OSS CVEs Fixed in PAN-OS
PAN-SA-2025-0012 Informational Bulletin: OSS CVEs Fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2018-6594 This CVE is fixed in PAN-OS 10.2.17, 11.1.11, 11.2.8, 12.1.2, and all later versions of PAN-OS CVE-2018-25032 This CVE is fixed in PAN-OS 10.1.7, 10.2.2, and all later versions of PAN-OS CVE-2019-5827 This CVE is fixed in PAN-OS 11.1.4, and all later versions of PAN-OS. CVE-2019-13750 This CVE is fixed in PAN-OS 11.1.4, and all later versions of PAN-OS. CVE-2019-13751 This CVE is fixed in PAN-OS 11.1.4, and all later versions
Palo Alto
PAN-SA-2025-0012 Informational Bulletin: OSS CVEs Fixed in PAN-OS
vendor_paloalto·2025-07-09·CVSS 7.5
CVE-2023-38546 [HIGH] PAN-SA-2025-0012 Informational Bulletin: OSS CVEs Fixed in PAN-OS
PAN-SA-2025-0012 Informational Bulletin: OSS CVEs Fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2018-6594 This CVE is fixed in PAN-OS 10.2.17, 11.1.11, 11.2.8, 12.1.2, and all later versions of PAN-OS CVE-2018-25032 This CVE is fixed in PAN-OS 10.1.7, 10.2.2, and all later versions of PAN-OS CVE-2019-5827 This CVE is fixed in PAN-OS 11.1.4, and all later versions of PAN-OS. CVE-2019-13750 This CVE is fixed in PAN-OS 11.1.4, and all later versions of PAN-OS. CVE-2019-13751 This CVE is fixed in PAN-OS 11.1.4, and all later versions
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-02-15
Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-15
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Out-of-bounds Read, Inadequate Encryption Strength, Double Free, Use After Free, NULL Pointer Dereference, Improper Input Validation, Missing Encryption of Sensitive Data, Allocation of Resources Wit
Ubuntu
curl vulnerabilities
vendor_ubuntu·2023-09-11·CVSS 5.9
CVE-2023-28322 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
USN-6237-1 fixed several vulnerabilities in curl. This update provides the
corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies
Apple
CVE-2023-28322: macOS Ventura 13.5
vendor_apple·2023-07-24·CVSS 3.7
CVE-2023-28322 [LOW] CVE-2023-28322: macOS Ventura 13.5
Apple Security Update: About the security content of macOS Ventura 13.5
Product: macOS Ventura
Version: 13.5
CVE: CVE-2023-28322
Component: CVE-2023-28322
Apple
CVE-2023-28322: macOS Monterey 12.6.8
vendor_apple·2023-07-24·CVSS 3.7
CVE-2023-28322 [LOW] CVE-2023-28322: macOS Monterey 12.6.8
Apple Security Update: About the security content of macOS Monterey 12.6.8
Product: macOS Monterey
Version: 12.6.8
CVE: CVE-2023-28322
Component: CVE-2023-28322
Apple
CVE-2023-28322: macOS Big Sur 11.7.9
vendor_apple·2023-07-24·CVSS 3.7
CVE-2023-28322 [LOW] CVE-2023-28322: macOS Big Sur 11.7.9
Apple Security Update: About the security content of macOS Big Sur 11.7.9
Product: macOS Big Sur
Version: 11.7.9
CVE: CVE-2023-28322
Component: CVE-2023-28322
Ubuntu
curl regression
vendor_ubuntu·2023-07-19·CVSS 5.9
[MEDIUM] curl regression
Title: curl regression
Summary: USN-6237-1 introduced a regression in curl.
USN-6237-1 fixed vulnerabilities in curl. The update caused a certificate
wildcard handling regression on Ubuntu 22.04 LTS. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorr
Ubuntu
curl vulnerabilities
vendor_ubuntu·2023-07-19·CVSS 5.9
CVE-2023-28321 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could possibly use this issue to create or overwrite files.
This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)
Instructions: In general,
Red Hat
curl: more POST-after-PUT confusion
vendor_redhat·2023-05-17·CVSS 3.7
CVE-2023-28322 [LOW] CWE-440 curl: more POST-after-PUT confusion
curl: more POST-after-PUT confusion
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.
A use-after-free flaw was found in the Curl package. This issue may lead to unintended information disclosure by the application.
Package: rh-dotnet31-curl
Microsoft
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send even when t
vendor_msrc·2023-05-09·CVSS 3.7
CVE-2023-28322 [LOW] CWE-200 An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send even when t
An information disclosure vulnerability exists in curl Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://lear
Debian
CVE-2023-28322: curl - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S...
vendor_debian·2023·CVSS 3.7
CVE-2023-28322 [LOW] CVE-2023-28322: curl - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S...
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.
Scope: local
bookworm: resolved (fixed in 7.88.1-10)
bullseye: resolved (fixed in 7.74.0-1.3+deb11u9)
forky: resolved (fixed in 7.88.1-10)
sid: resolved (fixed in 7.88.1-10)
trixie: resolved (fi
OSV
curl vulnerabilities
osv·2023-09-11·CVSS 5.9
CVE-2023-28321 [MEDIUM] curl vulnerabilities
curl vulnerabilities
USN-6237-1 fixed several vulnerabilities in curl. This update provides the
corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could possibly use this issue to
OSV
curl regression
osv·2023-07-19·CVSS 5.9
CVE-2023-28321 [MEDIUM] curl regression
curl regression
USN-6237-1 fixed vulnerabilities in curl. The update caused a certificate
wildcard handling regression on Ubuntu 22.04 LTS. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could
OSV
curl vulnerabilities
osv·2023-07-19·CVSS 5.9
CVE-2023-28321 [MEDIUM] curl vulnerabilities
curl vulnerabilities
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could possibly use this issue to create or overwrite files.
This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)
GHSA
GHSA-78jh-p6rf-g59w: An information disclosure vulnerability exists in curl <v8
ghsa_unreviewed·2023-05-26
CVE-2023-28322 [LOW] CWE-200 GHSA-78jh-p6rf-g59w: An information disclosure vulnerability exists in curl <v8
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.
OSV
CVE-2023-28322: An information disclosure vulnerability exists in curl <v8
osv·2023-05-26·CVSS 3.7
CVE-2023-28322 [LOW] CVE-2023-28322: An information disclosure vulnerability exists in curl <v8
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2023-28322: more POST-after-PUT confusion
hackerone·2023-06-25·CVSS 3.7
CVE-2023-28322 [LOW] CVE-2023-28322: more POST-after-PUT confusion
CVE-2023-28322: more POST-after-PUT confusion
Original Report:https://hackerone.com/reports/1954658
## Impact
CWE-440: Expected Behavior Violation
An attacker could potentially inject data, either from stdin or from an unintended buffer. Further, without even an active attacker, this could lead to segfaults or sensitive information being exposed to an unintended recipient.
CVE-2023-28322 - more POST-after-PUT confusion
VULNERABILITY
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback.
This flaw may surprise the application and cause it to misbehave and either send off the
HackerOne
CVE-2023-28322: more POST-after-PUT confusion
hackerone·2023-05-18·CVSS 9.8
CVE-2023-28322 [CRITICAL] CVE-2023-28322: more POST-after-PUT confusion
CVE-2023-28322: more POST-after-PUT confusion
## Summary:
CVE-2022-32221 fixes is insufficient.
In CVE-2022-32221, only CURLOPT_POST was corrected.
However, CURLOPT_POST is not necessarily used when sending data with the POST method.
CURLOPT_POST is not used in the CURLOPT_POSTFIELDS usage example on the official website.
```
CURL *curl = curl_easy_init();
if(curl) {
const char *data = "data to send";
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
/* size of the POST data */
curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 12L);
/* pass in a pointer to the data - libcurl will not copy */
curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data);
curl_easy_perform(curl);
}
```
Also on this page is the following statement.
>Using CURLOPT_POSTFIELDS implies setting CURLOPT_POST to 1.
http://seclists.org/fulldisclosure/2023/Jul/47http://seclists.org/fulldisclosure/2023/Jul/48http://seclists.org/fulldisclosure/2023/Jul/52https://hackerone.com/reports/1954658https://lists.debian.org/debian-lts-announce/2023/12/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/https://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230609-0009/https://support.apple.com/kb/HT213843https://support.apple.com/kb/HT213844https://support.apple.com/kb/HT213845http://seclists.org/fulldisclosure/2023/Jul/47http://seclists.org/fulldisclosure/2023/Jul/48http://seclists.org/fulldisclosure/2023/Jul/52https://hackerone.com/reports/1954658https://lists.debian.org/debian-lts-announce/2023/12/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/https://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230609-0009/https://support.apple.com/kb/HT213843https://support.apple.com/kb/HT213844https://support.apple.com/kb/HT213845
2023-05-26
Published