SUSE update for curl



Risk Medium
Patch available YES
Number of vulnerabilities 10
CVE-ID CVE-2022-43552
CVE-2023-23916
CVE-2023-27533
CVE-2023-27534
CVE-2023-27535
CVE-2023-27536
CVE-2023-27538
CVE-2023-28320
CVE-2023-28321
CVE-2023-28322
CWE-ID CWE-416
CWE-770
CWE-20
CWE-371
CWE-200
CWE-662
CWE-295
CWE-440
Exploitation vector Network
Public exploit N/A
Vulnerable software
 SUSE Linux Enterprise Server for SAP Applications 12
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 12 SP4 LTSS
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 12 SP4 ESPOS
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 12
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing 12
Operating systems & Components / Operating system

SUSE OpenStack Cloud Crowbar
Operating systems & Components / Operating system

SUSE OpenStack Cloud
Operating systems & Components / Operating system

curl
Operating systems & Components / Operating system package or component

curl-debuginfo
Operating systems & Components / Operating system package or component

libcurl4
Operating systems & Components / Operating system package or component

libcurl4-debuginfo-32bit
Operating systems & Components / Operating system package or component

curl-debugsource
Operating systems & Components / Operating system package or component

libcurl4-32bit
Operating systems & Components / Operating system package or component

libcurl4-debuginfo
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 10 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU70456

Risk: Low

CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-43552

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error while processing denied requests from HTTP proxies when using SMB or TELNET protocols. A remote attacker can trigger a use-after-free error and crash the application.


Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP4

SUSE Linux Enterprise High Performance Computing 12: SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

curl: before 7.60.0-4.56.1

curl-debuginfo: before 7.60.0-4.56.1

libcurl4: before 7.60.0-4.56.1

libcurl4-debuginfo-32bit: before 7.60.0-4.56.1

curl-debugsource: before 7.60.0-4.56.1

libcurl4-32bit: before 7.60.0-4.56.1

libcurl4-debuginfo: before 7.60.0-4.56.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU72337

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-23916

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect implementation of the "chained" HTTP compression algorithms, where the number of links in the decompression chain was limited for each header instead of the entire request. A remote attacker can send a specially crafted compressed HTTP request with numerous headers and perform a denial of service (DoS) attack.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP4

SUSE Linux Enterprise High Performance Computing 12: SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

curl: before 7.60.0-4.56.1

curl-debuginfo: before 7.60.0-4.56.1

libcurl4: before 7.60.0-4.56.1

libcurl4-debuginfo-32bit: before 7.60.0-4.56.1

curl-debugsource: before 7.60.0-4.56.1

libcurl4-32bit: before 7.60.0-4.56.1

libcurl4-debuginfo: before 7.60.0-4.56.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU73826

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-27533

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to manipulate requests.

The vulnerability exists due to missing documentation of the TELNET protocol support and the ability to pass on user name and "telnet options" for the server negotiation. A remote attacker can manipulate the connection sending unexpected data to the server via the affected client.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP4

SUSE Linux Enterprise High Performance Computing 12: SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

curl: before 7.60.0-4.56.1

curl-debuginfo: before 7.60.0-4.56.1

libcurl4: before 7.60.0-4.56.1

libcurl4-debuginfo-32bit: before 7.60.0-4.56.1

curl-debugsource: before 7.60.0-4.56.1

libcurl4-32bit: before 7.60.0-4.56.1

libcurl4-debuginfo: before 7.60.0-4.56.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU73827

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-27534

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in the SFTP support when handling the tilde "~" character in the filepath. cURL will replace the tilde character to the current user's home directory and can reveal otherwise restricted files.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP4

SUSE Linux Enterprise High Performance Computing 12: SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

curl: before 7.60.0-4.56.1

curl-debuginfo: before 7.60.0-4.56.1

libcurl4: before 7.60.0-4.56.1

libcurl4-debuginfo-32bit: before 7.60.0-4.56.1

curl-debugsource: before 7.60.0-4.56.1

libcurl4-32bit: before 7.60.0-4.56.1

libcurl4-debuginfo: before 7.60.0-4.56.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) State Issues

EUVDB-ID: #VU73828

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-27535

CWE-ID: CWE-371 - State Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to FTP server.

The vulnerability exists due to cURL will reuse a previously created FTP connection even when one or more options had been changed that could have made the effective user a very different one. A remote attacker can connect to the FTP server using credentials supplied by another user and gain access to otherwise restricted functionality.

The settings in questions are CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC and CURLOPT_USE_SSL level.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP4

SUSE Linux Enterprise High Performance Computing 12: SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

curl: before 7.60.0-4.56.1

curl-debuginfo: before 7.60.0-4.56.1

libcurl4: before 7.60.0-4.56.1

libcurl4-debuginfo-32bit: before 7.60.0-4.56.1

curl-debugsource: before 7.60.0-4.56.1

libcurl4-32bit: before 7.60.0-4.56.1

libcurl4-debuginfo: before 7.60.0-4.56.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) State Issues

EUVDB-ID: #VU73829

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-27536

CWE-ID: CWE-371 - State Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to cURL will reuse a previously created connection even when the GSS delegation (CURLOPT_GSSAPI_DELEGATION) option had been changed that could have changed the user's permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP4

SUSE Linux Enterprise High Performance Computing 12: SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

curl: before 7.60.0-4.56.1

curl-debuginfo: before 7.60.0-4.56.1

libcurl4: before 7.60.0-4.56.1

libcurl4-debuginfo-32bit: before 7.60.0-4.56.1

curl-debugsource: before 7.60.0-4.56.1

libcurl4-32bit: before 7.60.0-4.56.1

libcurl4-debuginfo: before 7.60.0-4.56.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Information disclosure

EUVDB-ID: #VU73831

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-27538

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way libcurl handles previously used connections in a connection pool for subsequent transfers. Several SSH settings were left out from the configuration match checks, resulting in erroneous matches for different resources. As a result, libcurl can send authentication string from one resource to another, exposing credentials to a third-party.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP4

SUSE Linux Enterprise High Performance Computing 12: SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

curl: before 7.60.0-4.56.1

curl-debuginfo: before 7.60.0-4.56.1

libcurl4: before 7.60.0-4.56.1

libcurl4-debuginfo-32bit: before 7.60.0-4.56.1

curl-debugsource: before 7.60.0-4.56.1

libcurl4-32bit: before 7.60.0-4.56.1

libcurl4-debuginfo: before 7.60.0-4.56.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper synchronization

EUVDB-ID: #VU76235

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-28320

CWE-ID: CWE-662 - Improper Synchronization

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper synchronization when resolving host names using the alarm() and siglongjmp() function. A remote attacker can force the application to crash by influencing contents of the global buffer.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP4

SUSE Linux Enterprise High Performance Computing 12: SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

curl: before 7.60.0-4.56.1

curl-debuginfo: before 7.60.0-4.56.1

libcurl4: before 7.60.0-4.56.1

libcurl4-debuginfo-32bit: before 7.60.0-4.56.1

curl-debugsource: before 7.60.0-4.56.1

libcurl4-32bit: before 7.60.0-4.56.1

libcurl4-debuginfo: before 7.60.0-4.56.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper certificate validation

EUVDB-ID: #VU76237

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28321

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation when matching wildcards in TLS certificates for IDN names. A remote attacker crate a specially crafted certificate that will be considered trusted by the library.

Successful exploitation of the vulnerability requires that curl is built to use OpenSSL, Schannel or Gskit.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP4

SUSE Linux Enterprise High Performance Computing 12: SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

curl: before 7.60.0-4.56.1

curl-debuginfo: before 7.60.0-4.56.1

libcurl4: before 7.60.0-4.56.1

libcurl4-debuginfo-32bit: before 7.60.0-4.56.1

curl-debugsource: before 7.60.0-4.56.1

libcurl4-32bit: before 7.60.0-4.56.1

libcurl4-debuginfo: before 7.60.0-4.56.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Expected behavior violation

EUVDB-ID: #VU76238

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28322

CWE-ID: CWE-440 - Expected Behavior Violation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a logic error when sending HTTP POST and PUT requests using the same handle. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. As a result, the application can misbehave and either send off the wrong data or use memory after free or similar in the second transfer.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP4

SUSE Linux Enterprise High Performance Computing 12: SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

curl: before 7.60.0-4.56.1

curl-debuginfo: before 7.60.0-4.56.1

libcurl4: before 7.60.0-4.56.1

libcurl4-debuginfo-32bit: before 7.60.0-4.56.1

curl-debugsource: before 7.60.0-4.56.1

libcurl4-32bit: before 7.60.0-4.56.1

libcurl4-debuginfo: before 7.60.0-4.56.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###