https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 08:21:15 +0000 https://vulnerability.circl.lu/vuln/cve-2023-38546 <p><strong>Affected:</strong> curl, Siemens RUGGEDCOM APE1808, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP</p> <p>This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.</p> <p>libcurl performs transfers. In its API, an application creates &#34;easy handles&#34; that are the individual handles for single transfers.</p> <p>libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).</p> <p>If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes).</p> <p>Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.</p> <p><strong>Affected:</strong> curl, Siemens RUGGEDCOM APE1808, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP</p> <p>This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.</p> <p>libcurl performs transfers. In its API, an application creates &#34;easy handles&#34; that are the individual handles for single transfers.</p> <p>libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).</p> <p>If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes).</p> <p>Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.</p> https://vulnerability.circl.lu/vuln/cve-2023-38546