cve-2023-46219
Vulnerability from cvelistv5
Published
2023-12-12 01:38
Modified
2024-08-02 20:37
Severity
Summary
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
References
SourceURLTags
support@hackerone.comhttps://curl.se/docs/CVE-2023-46219.htmlVendor Advisory
support@hackerone.comhttps://hackerone.com/reports/2236133Exploit, Third Party Advisory
support@hackerone.comhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/Third Party Advisory
support@hackerone.comhttps://security.netapp.com/advisory/ntap-20240119-0007/
support@hackerone.comhttps://www.debian.org/security/2023/dsa-5587
Impacted products
VendorProduct
curlcurl
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:37:40.116Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/2236133"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://curl.se/docs/CVE-2023-46219.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5587"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240119-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.4.0",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.84.0",
              "status": "unaffected",
              "version": "7.84.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When saving HSTS data to an excessively long file name, curl could end up\nremoving all contents, making subsequent requests using that file unaware of\nthe HSTS status they should otherwise use.\n"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-12T01:38:41.376Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/2236133"
        },
        {
          "url": "https://curl.se/docs/CVE-2023-46219.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5587"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240119-0007/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-46219",
    "datePublished": "2023-12-12T01:38:41.376Z",
    "dateReserved": "2023-10-19T01:00:12.854Z",
    "dateUpdated": "2024-08-02T20:37:40.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-46219\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2023-12-12T02:15:06.990\",\"lastModified\":\"2024-01-19T16:15:09.430\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"When saving HSTS data to an excessively long file name, curl could end up\\nremoving all contents, making subsequent requests using that file unaware of\\nthe HSTS status they should otherwise use.\\n\"},{\"lang\":\"es\",\"value\":\"Al guardar datos HSTS en un nombre de archivo excesivamente largo, curl podr\u00eda terminar eliminando todo el contenido, haciendo que las solicitudes posteriores que utilicen ese archivo desconozcan el estado HSTS que de otro modo deber\u00edan usar.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-311\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.84.0\",\"versionEndExcluding\":\"8.5.0\",\"matchCriteriaId\":\"3CB1957F-EDD4-4112-BD94-54D30FDE6E5B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"}]}]}],\"references\":[{\"url\":\"https://curl.se/docs/CVE-2023-46219.html\",\"source\":\"support@hackerone.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://hackerone.com/reports/2236133\",\"source\":\"support@hackerone.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240119-0007/\",\"source\":\"support@hackerone.com\"},{\"url\":\"https://www.debian.org/security/2023/dsa-5587\",\"source\":\"support@hackerone.com\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.