SUSE update for curl

Published: 2023-05-17

Risk	Medium
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2023-28319 CVE-2023-28320 CVE-2023-28321 CVE-2023-28322
CWE-ID	CWE-416 CWE-662 CWE-295 CWE-440
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	SUSE Linux Enterprise Micro for Rancher Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system Basesystem Module Operating systems & Components / Operating system openSUSE Leap Micro Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system libcurl-devel-32bit Operating systems & Components / Operating system package or component libcurl4-32bit Operating systems & Components / Operating system package or component libcurl4-32bit-debuginfo Operating systems & Components / Operating system package or component libcurl-devel Operating systems & Components / Operating system package or component curl-debugsource Operating systems & Components / Operating system package or component libcurl4 Operating systems & Components / Operating system package or component curl-debuginfo Operating systems & Components / Operating system package or component libcurl4-debuginfo Operating systems & Components / Operating system package or component curl Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU76233

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-28319

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a use-after-free error when checking the SSH sha256 fingerprint. A remote attacker can use the application to connect to a malicious SSH server, trigger a use-after-free error and gain access to potentially sensitive information.

Successful exploitation of the vulnerability requires usage of the the CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 option, and also CURLOPT_VERBOSE or CURLOPT_ERRORBUFFER options have to be set.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.3 - 5.4

SUSE Linux Enterprise Micro: 5.3 - 5.4

SUSE Linux Enterprise Server for SAP Applications 15: SP4

SUSE Linux Enterprise Server 15: SP4

SUSE Linux Enterprise Real Time 15: SP4

SUSE Linux Enterprise High Performance Computing 15: SP4

SUSE Linux Enterprise Desktop 15: SP4

Basesystem Module: 15-SP4

openSUSE Leap Micro: 5.3

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

openSUSE Leap: 15.4

libcurl-devel-32bit: before 8.0.1-150400.5.23.1

libcurl4-32bit: before 8.0.1-150400.5.23.1

libcurl4-32bit-debuginfo: before 8.0.1-150400.5.23.1

libcurl-devel: before 8.0.1-150400.5.23.1

curl-debugsource: before 8.0.1-150400.5.23.1

libcurl4: before 8.0.1-150400.5.23.1

curl-debuginfo: before 8.0.1-150400.5.23.1

libcurl4-debuginfo: before 8.0.1-150400.5.23.1

curl: before 8.0.1-150400.5.23.1

CPE2.3

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232224-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper synchronization

EUVDB-ID: #VU76235

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-28320

CWE-ID: CWE-662 - Improper Synchronization

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper synchronization when resolving host names using the alarm() and siglongjmp() function. A remote attacker can force the application to crash by influencing contents of the global buffer.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.3 - 5.4

SUSE Linux Enterprise Micro: 5.3 - 5.4

SUSE Linux Enterprise Server for SAP Applications 15: SP4

SUSE Linux Enterprise Server 15: SP4

SUSE Linux Enterprise Real Time 15: SP4

SUSE Linux Enterprise High Performance Computing 15: SP4

SUSE Linux Enterprise Desktop 15: SP4

Basesystem Module: 15-SP4

openSUSE Leap Micro: 5.3

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

openSUSE Leap: 15.4

libcurl-devel-32bit: before 8.0.1-150400.5.23.1

libcurl4-32bit: before 8.0.1-150400.5.23.1

libcurl4-32bit-debuginfo: before 8.0.1-150400.5.23.1

libcurl-devel: before 8.0.1-150400.5.23.1

curl-debugsource: before 8.0.1-150400.5.23.1

libcurl4: before 8.0.1-150400.5.23.1

curl-debuginfo: before 8.0.1-150400.5.23.1

libcurl4-debuginfo: before 8.0.1-150400.5.23.1

curl: before 8.0.1-150400.5.23.1

CPE2.3

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232224-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper certificate validation

EUVDB-ID: #VU76237

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28321

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation when matching wildcards in TLS certificates for IDN names. A remote attacker crate a specially crafted certificate that will be considered trusted by the library.

Successful exploitation of the vulnerability requires that curl is built to use OpenSSL, Schannel or Gskit.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.3 - 5.4

SUSE Linux Enterprise Micro: 5.3 - 5.4

SUSE Linux Enterprise Server for SAP Applications 15: SP4

SUSE Linux Enterprise Server 15: SP4

SUSE Linux Enterprise Real Time 15: SP4

SUSE Linux Enterprise High Performance Computing 15: SP4

SUSE Linux Enterprise Desktop 15: SP4

Basesystem Module: 15-SP4

openSUSE Leap Micro: 5.3

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

openSUSE Leap: 15.4

libcurl-devel-32bit: before 8.0.1-150400.5.23.1

libcurl4-32bit: before 8.0.1-150400.5.23.1

libcurl4-32bit-debuginfo: before 8.0.1-150400.5.23.1

libcurl-devel: before 8.0.1-150400.5.23.1

curl-debugsource: before 8.0.1-150400.5.23.1

libcurl4: before 8.0.1-150400.5.23.1

curl-debuginfo: before 8.0.1-150400.5.23.1

libcurl4-debuginfo: before 8.0.1-150400.5.23.1

curl: before 8.0.1-150400.5.23.1

CPE2.3

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232224-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Expected behavior violation

EUVDB-ID: #VU76238

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28322

CWE-ID: CWE-440 - Expected Behavior Violation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a logic error when sending HTTP POST and PUT requests using the same handle. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. As a result, the application can misbehave and either send off the wrong data or use memory after free or similar in the second transfer.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.3 - 5.4

SUSE Linux Enterprise Micro: 5.3 - 5.4

SUSE Linux Enterprise Server for SAP Applications 15: SP4

SUSE Linux Enterprise Server 15: SP4

SUSE Linux Enterprise Real Time 15: SP4

SUSE Linux Enterprise High Performance Computing 15: SP4

SUSE Linux Enterprise Desktop 15: SP4

Basesystem Module: 15-SP4

openSUSE Leap Micro: 5.3

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

openSUSE Leap: 15.4

libcurl-devel-32bit: before 8.0.1-150400.5.23.1

libcurl4-32bit: before 8.0.1-150400.5.23.1

libcurl4-32bit-debuginfo: before 8.0.1-150400.5.23.1

libcurl-devel: before 8.0.1-150400.5.23.1

curl-debugsource: before 8.0.1-150400.5.23.1

libcurl4: before 8.0.1-150400.5.23.1

curl-debuginfo: before 8.0.1-150400.5.23.1

libcurl4-debuginfo: before 8.0.1-150400.5.23.1

curl: before 8.0.1-150400.5.23.1

CPE2.3

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232224-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.