SB2023022428 - openEuler 22.03 LTS SP1 update for curl 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023022428

SB2023022428 - openEuler 22.03 LTS SP1 update for curl

Published: February 24, 2023

Security Bulletin ID SB2023022428
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Cleartext transmission of sensitive information (CVE-ID: CVE-2023-23915)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to state issues when handling multiple transfers in parallel, which results in ignoring HSTS support. A remote attacker can perform MitM attack.

2) Cleartext transmission of sensitive information (CVE-ID: CVE-2023-23914)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to state issues when handling multiple requests, which results in ignoring HSTS support. A remote attacker can perform MitM attack.

3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2023-23916)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect implementation of the "chained" HTTP compression algorithms, where the number of links in the decompression chain was limited for each header instead of the entire request. A remote attacker can send a specially crafted compressed HTTP request with numerous headers and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References