First published: Fri May 26 2023(Updated: )
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
Credit: CVE-2023-28319 CVE-2023-28320 CVE-2023-28321 CVE-2023-28322 support@hackerone.com
Affected Software | Affected Version | How to fix |
---|---|---|
Apple macOS | <11.7.9 | 11.7.9 |
IBM Engineering Requirements Management DOORS Web Access | <=9.7.2.7 | |
IBM Rational DOORS Web Access | <=9.7.2.7 | |
curl | <8.1.0 | |
macOS | <12.6.8 | 12.6.8 |
macOS Ventura | <13.5 | 13.5 |
Curl | <8.1.0 | |
macOS | >=11.0<11.7.9 | |
macOS | >=12.0<12.6.8 | |
macOS | >=13.0<13.5 | |
IBM Data ONTAP | ||
NetApp Clustered Data ONTAP Antivirus Connector | ||
All of | ||
NetApp H300S Firmware | ||
NetApp H300S Firmware | ||
All of | ||
NetApp H500e Firmware | ||
NetApp H500e Firmware | ||
All of | ||
NetApp H700S | ||
NetApp H700S | ||
All of | ||
NetApp H410S | ||
NetApp H410S Firmware | ||
NetApp H300S Firmware | ||
NetApp H300S Firmware | ||
NetApp H500e Firmware | ||
NetApp H500e Firmware | ||
NetApp H700S | ||
NetApp H700S | ||
NetApp H410S | ||
NetApp H410S Firmware |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Found alongside the following vulnerabilities)
The vulnerability ID of this issue is CVE-2023-28320.
The severity of CVE-2023-28320 is medium with a CVSS score of 5.9.
This vulnerability affects Haxx Curl versions up to 8.1.0, Apple macOS versions between 11.0 and 11.7.9, Apple macOS versions between 12.0 and 12.6.8, and Apple macOS versions between 13.0 and 13.5.
This vulnerability in curl is a denial of service vulnerability related to the way libcurl provides backends for resolving host names.
To fix this vulnerability in curl, update to a version above 8.1.0 if using Haxx Curl, or update to the latest available version of Apple macOS if using any affected versions.