CVE-2023-38546: Curl and libcurl CVE-2023-38545 and CVE-2023-38546 vulnerabilities
First published: Tue Oct 03 2023(Updated: )
cURL libcurl could allow a remote attacker to bypass security restrictions, caused by a flaw in the curl_easy_duphandle function if a transfer has cookies enabled when the handle is duplicated. By sending a specially crafted request, an attacker could exploit this vulnerability to insert cookies at will into a running program.
Credit: support@hackerone.com CVE-2023-38545 CVE-2023-38039 CVE-2023-38546 CVE-2023-42915 support@hackerone.com support@hackerone.com CVE-2023-38545 CVE-2023-38039 CVE-2023-38546 CVE-2023-38545 CVE-2023-38039 CVE-2023-38546 CVE-2023-38545 CVE-2023-38039 CVE-2023-38546
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iOS | <16.7.5 | 16.7.5 |
| Apple iPadOS | <16.7.5 | 16.7.5 |
| Apple macOS Ventura | <13.6.4 | 13.6.4 |
| Apple macOS Monterey | <12.7.3 | 12.7.3 |
| redhat/curl | <8.4.0 | 8.4.0 |
| ubuntu/curl | <7.58.0-2ubuntu3.24+ | 7.58.0-2ubuntu3.24+ |
| ubuntu/curl | <7.68.0-1ubuntu2.20 | 7.68.0-1ubuntu2.20 |
| ubuntu/curl | <7.81.0-1ubuntu1.14 | 7.81.0-1ubuntu1.14 |
| ubuntu/curl | <7.88.1-8ubuntu2.3 | 7.88.1-8ubuntu2.3 |
| ubuntu/curl | <8.2.1-1ubuntu3.1 | 8.2.1-1ubuntu3.1 |
| ubuntu/curl | <8.2.1-1ubuntu3.1 | 8.2.1-1ubuntu3.1 |
| ubuntu/curl | <7.35.0-1ubuntu2.20+ | 7.35.0-1ubuntu2.20+ |
| ubuntu/curl | <7.47.0-1ubuntu2.19+ | 7.47.0-1ubuntu2.19+ |
| Haxx Libcurl | >=7.9.1<8.4.0 | |
| Apple macOS Sonoma | <14.2 | 14.2 |
| debian/curl | 7.74.0-1.3+deb11u12 7.74.0-1.3+deb11u11 7.88.1-10+deb12u6 7.88.1-10+deb12u5 8.8.0-4 8.9.1-1 | |
| IBM QRadar Network Packet Capture | <=7.5.0 - 7.5.0 Update Package 7 | |
| Fortinet FortiExtender | >=7.4.0<=7.4.1 | |
| Fortinet FortiExtender | >=7.2.0<=7.2.3 | |
| Fortinet FortiOS (only FGT_VM64) | >=7.4.0<=7.4.1 | |
| Fortinet FortiOS (only FGT_VM64) | >=7.2.0<=7.2.6 | |
| Fortinet FortiOS (only FGT_VM64) | >=7.0.1<=7.0.13 | |
| Fortinet FortiProxy (only FortiProxy_VM64) | >=7.4.0<=7.4.1 | |
| Fortinet FortiProxy (only FortiProxy_VM64) | >=7.2.0<=7.2.7 | |
| Fortinet FortiProxy (only FortiProxy_VM64) | >=7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://curl.se/docs/CVE-2023-38546.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/
- https://support.apple.com/kb/HT214057
- https://support.apple.com/kb/HT214058
- https://support.apple.com/kb/HT214063
- https://support.apple.com/kb/HT214036
- http://seclists.org/fulldisclosure/2024/Jan/34
- http://seclists.org/fulldisclosure/2024/Jan/37
- http://seclists.org/fulldisclosure/2024/Jan/38
- https://launchpad.net/bugs/cve/CVE-2023-38546
- https://support.apple.com/en-us/HT214063 (Advisory)
- https://support.apple.com/en-us/HT214058 (Advisory)
- https://support.apple.com/en-us/HT214057 (Advisory)
- https://access.redhat.com/errata/RHSA-2023:5700
- https://access.redhat.com/errata/RHSA-2023:5763
- https://access.redhat.com/errata/RHSA-2023:6292
- https://access.redhat.com/errata/RHSA-2023:6745
- https://access.redhat.com/security/cve/cve-2023-38546
- https://access.redhat.com/errata/RHSA-2023:7540
- https://access.redhat.com/errata/RHSA-2023:7625
- https://access.redhat.com/errata/RHSA-2023:7626
- https://access.redhat.com/errata/RHSA-2024:1601
- https://access.redhat.com/errata/RHSA-2024:2101
- https://bugzilla.redhat.com/show_bug.cgi?id=2241938
- https://ubuntu.com/security/notices/USN-6429-1
- https://ubuntu.com/security/notices/USN-6429-2
- https://ubuntu.com/security/notices/USN-6429-3
- https://www.cve.org/CVERecord?id=CVE-2023-38546
- https://nvd.nist.gov/vuln/detail/CVE-2023-38546
- https://security-tracker.debian.org/tracker/CVE-2023-38546
- https://github.com/curl/curl/commit/61275672b46d9abb32857404
- https://ubuntu.com/security/CVE-2023-38546
- https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868
- https://support.apple.com/en-us/HT214036 (Advisory)
- https://github.com/curl/curl/commit/74d5a6fb3b9a96d9fa51ba90996e94c878ebd151
- https://github.com/curl/curl/commit/61275672b46d9abb3285740467b882e22ed75da8
- https://exchange.xforce.ibmcloud.com/vulnerabilities/268046
- https://www.ibm.com/support/pages/node/7160961 (Advisory)
- https://www.fortiguard.com/psirt/cvrf/FG-IR-23-385
- https://www.fortiguard.com/psirt/FG-IR-23-385
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2023-42937
- CVE-2024-23212
- CVE-2023-38545
- CVE-2023-38039
- CVE-2023-38546
- CVE-2023-42915
- CVE-2023-42888
- CVE-2024-23211
- CVE-2024-23213
- CVE-2024-23214
- CVE-2024-23206
- CVE-2024-23222
- CVE-2023-40528
- CVE-2024-23224
- CVE-2023-42935
- CVE-2024-23207
- CVE-2023-42887
- CVE-2024-27791
- CVE-2023-42874
- CVE-2023-42919
- CVE-2023-42894
- CVE-2023-42901
- CVE-2023-42902
- CVE-2023-42912
- CVE-2023-42903
- CVE-2023-42904
- CVE-2023-42905
- CVE-2023-42906
- CVE-2023-42907
- CVE-2023-42908
- CVE-2023-42909
- CVE-2023-42910
- CVE-2023-42911
- CVE-2023-42926
- CVE-2023-42882
- CVE-2023-42881
- CVE-2023-42924
- CVE-2023-42896
- CVE-2023-42884
- CVE-2023-45866
- CVE-2023-42900
- CVE-2023-42886
- CVE-2023-42931
- CVE-2023-42892
- CVE-2023-42922
- CVE-2023-42898
- CVE-2023-42899
- CVE-2023-42891
- CVE-2023-42974
- CVE-2023-42914
- CVE-2023-42893
- CVE-2023-3618
- CVE-2020-19185
- CVE-2020-19186
- CVE-2020-19187
- CVE-2020-19188
- CVE-2020-19189
- CVE-2020-19190
- CVE-2023-42936
- CVE-2023-40390
- CVE-2023-42842
- CVE-2023-42930
- CVE-2023-42913
- CVE-2023-42932
- CVE-2023-42947
- CVE-2023-40389
- CVE-2023-5344
- CVE-2023-42890
- CVE-2023-42883
- CVE-2023-42950
- CVE-2023-42956
Frequently Asked Questions
What is CVE-2023-38546?
CVE-2023-38546 is a vulnerability in curl that allows cookie injection with none file.
How does CVE-2023-38546 affect Ubuntu?
CVE-2023-38546 affects Ubuntu versions 7.68.0-1ubuntu2.20, 7.81.0-1ubuntu1.14, and 7.88.1-8ubuntu2.3.
How does CVE-2023-38546 affect Debian?
CVE-2023-38546 affects Debian versions 7.64.0-4+deb10u7, 7.74.0-1.3+deb11u10, 7.88.1-10+deb12u4, and 8.3.0-3.
Where can I find more information about CVE-2023-38546?
You can find more information about CVE-2023-38546 on the MITRE CVE website, the curl documentation, and the Ubuntu security notices page.
How can I fix CVE-2023-38546?
To fix CVE-2023-38546, update curl to the recommended versions provided by the respective Linux distributions.
- collector/oss-sec
- alias/CVE-2023-38546
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/remedy
- collector/launchpad-cve
- source/Launchpad
- agent/weakness
- agent/author
- collector/apple-support
- source/Apple
- alias/CVE-2023-38039
- alias/CVE-2023-42915
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- collector/usn-cve
- source/Ubuntu
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- collector/security-tracker-debian
- source/Debian
- collector/ibm-support
- source/IBM
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2023-38545
- agent/title
- agent/references
- agent/event
- agent/description
- agent/tags
- agent/softwarecombine
- collector/fortiguard-psirt
- vendor/apple
- canonical/apple ios
- canonical/apple ipados
- canonical/apple macos ventura
- canonical/apple macos monterey
- package-manager/redhat
- package-manager/ubuntu
- vendor/haxx
- canonical/haxx libcurl
- version/haxx libcurl/7.9.1
- canonical/apple macos sonoma
- package-manager/debian
- vendor/ibm
- canonical/ibm qradar network packet capture
- version/ibm qradar network packet capture/7.5.0 - 7.5.0 update package 7
- vendor/fortinet
- canonical/fortinet fortiextender
- version/fortinet fortiextender/7.4.0
- version/fortinet fortiextender/7.4.1
- version/fortinet fortiextender/7.2.0
- version/fortinet fortiextender/7.2.3
- canonical/fortinet fortios (only fgt_vm64)
- version/fortinet fortios (only fgt_vm64)/7.4.0
- version/fortinet fortios (only fgt_vm64)/7.4.1
- version/fortinet fortios (only fgt_vm64)/7.2.0
- version/fortinet fortios (only fgt_vm64)/7.2.6
- version/fortinet fortios (only fgt_vm64)/7.0.1
- version/fortinet fortios (only fgt_vm64)/7.0.13
- canonical/fortinet fortiproxy (only fortiproxy_vm64)
- version/fortinet fortiproxy (only fortiproxy_vm64)/7.4.0
- version/fortinet fortiproxy (only fortiproxy_vm64)/7.4.1
- canonical/fortinet fortiproxy (only fortiproxy_vm64)
- version/fortinet fortiproxy (only fortiproxy_vm64)/7.2.0
- version/fortinet fortiproxy (only fortiproxy_vm64)/7.2.7
- version/fortinet fortiproxy (only fortiproxy_vm64)/7.0