Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:4650-1

Опубликовано: 06 дек. 2023
Источник: suse-cvrf

Описание

Security update for curl

This update for curl fixes the following issues:

  • CVE-2023-38546: Fixed a cookie injection with none file (bsc#1215889).
  • CVE-2023-46218: Fixed cookie mixed case PSL bypass (bsc#1217573).

Список пакетов

Container suse/sle15:15.1
libcurl4-7.60.0-150000.56.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
curl-7.60.0-150000.56.1
libcurl-devel-7.60.0-150000.56.1
libcurl4-7.60.0-150000.56.1
libcurl4-32bit-7.60.0-150000.56.1
SUSE Linux Enterprise Server 15 SP1-LTSS
curl-7.60.0-150000.56.1
libcurl-devel-7.60.0-150000.56.1
libcurl4-7.60.0-150000.56.1
libcurl4-32bit-7.60.0-150000.56.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1
curl-7.60.0-150000.56.1
libcurl-devel-7.60.0-150000.56.1
libcurl4-7.60.0-150000.56.1
libcurl4-32bit-7.60.0-150000.56.1

Ссылки

Описание

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Затронутые продукты
Container suse/sle15:15.1:libcurl4-7.60.0-150000.56.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:curl-7.60.0-150000.56.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl-devel-7.60.0-150000.56.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.56.1
Ссылки

Описание

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.

Затронутые продукты
Container suse/sle15:15.1:libcurl4-7.60.0-150000.56.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:curl-7.60.0-150000.56.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl-devel-7.60.0-150000.56.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-32bit-7.60.0-150000.56.1
Ссылки