CVE-2023-46219: Medium severity haxx curl vulnerability
Last updated 24 July 2024
Other sources
When saving HSTS data to an excessively long file name curl could end up removing all contents making subsequent requests using that file unaware of the HSTS status they should otherwise use.
— Microsoft
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u7Fixed in 7.88.1-10+deb12u5Fixed in 8.9.1-2Fixed in 8.10.0-2 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
What is CVE-2023-46219?
CVE-2023-46219 is a vulnerability in the curl package that allows an attacker to clear the contents of a file with a long name when using HTTP Strict Transport Security (HSTS).
Which software versions are affected?
The affected software versions include curl 8.5.0 and earlier, curl 7.88.1-8ubuntu2.4 and earlier, curl 8.2.1-1ubuntu3.2 and earlier, and curl 7.64.0-4+deb10u2 to curl 8.4.0-2.
How can I fix the CVE-2023-46219 vulnerability?
To fix the CVE-2023-46219 vulnerability, update the curl package to a version that includes the necessary security patches.
Where can I find more information about CVE-2023-46219?
You can find more information about CVE-2023-46219 on the MITRE CVE website (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46219) and the curl documentation (https://curl.se/docs/CVE-2023-46219.html).
Are there any security notices related to CVE-2023-46219?
Yes, you can refer to the Ubuntu security notice USN-6535-1 (https://ubuntu.com/security/notices/USN-6535-1) for more information on the CVE-2023-46219 vulnerability.