Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
EUVDB-ID: #VU62641
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-27774
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to curl attempts to follow redirects during authentication process and does not consider different port numbers or protocols to be separate authentication targets. If the web application performs redirection to a different port number of protocol, cURL will allow such redirection and will pass credentials. It could also leak the TLS SRP credentials this way.
By default, curl only allows redirects to HTTP(S) and FTP(S), but can be asked to allow redirects to all protocols curl supports.
MitigationUpdate the affected package curl to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Software Development Kit 12: SP5
SUSE Linux Enterprise Server for SAP Applications 12: SP5
SUSE Linux Enterprise Server 12: SP5
SUSE Linux Enterprise High Performance Computing 12: SP5
libcurl4-debuginfo-32bit: before 8.0.1-11.65.2
libcurl4-32bit: before 8.0.1-11.65.2
libcurl4-debuginfo: before 8.0.1-11.65.2
libcurl4: before 8.0.1-11.65.2
curl: before 8.0.1-11.65.2
curl-debuginfo: before 8.0.1-11.65.2
libcurl-devel: before 8.0.1-11.65.2
curl-debugsource: before 8.0.1-11.65.2
External linkshttp://www.suse.com/support/update/announcement/2023/suse-su-20232225-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU76233
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-28319
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a use-after-free error when checking the SSH sha256 fingerprint. A remote attacker can use the application to connect to a malicious SSH server, trigger a use-after-free error and gain access to potentially sensitive information.
Successful exploitation of the vulnerability requires usage of the the CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 option, and also CURLOPT_VERBOSE or CURLOPT_ERRORBUFFER options have to be set.
Update the affected package curl to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Software Development Kit 12: SP5
SUSE Linux Enterprise Server for SAP Applications 12: SP5
SUSE Linux Enterprise Server 12: SP5
SUSE Linux Enterprise High Performance Computing 12: SP5
libcurl4-debuginfo-32bit: before 8.0.1-11.65.2
libcurl4-32bit: before 8.0.1-11.65.2
libcurl4-debuginfo: before 8.0.1-11.65.2
libcurl4: before 8.0.1-11.65.2
curl: before 8.0.1-11.65.2
curl-debuginfo: before 8.0.1-11.65.2
libcurl-devel: before 8.0.1-11.65.2
curl-debugsource: before 8.0.1-11.65.2
External linkshttp://www.suse.com/support/update/announcement/2023/suse-su-20232225-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU76235
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-28320
CWE-ID:
CWE-662 - Improper Synchronization
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper synchronization when resolving host names using the alarm() and siglongjmp() function. A remote attacker can force the application to crash by influencing contents of the global buffer.
Update the affected package curl to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Software Development Kit 12: SP5
SUSE Linux Enterprise Server for SAP Applications 12: SP5
SUSE Linux Enterprise Server 12: SP5
SUSE Linux Enterprise High Performance Computing 12: SP5
libcurl4-debuginfo-32bit: before 8.0.1-11.65.2
libcurl4-32bit: before 8.0.1-11.65.2
libcurl4-debuginfo: before 8.0.1-11.65.2
libcurl4: before 8.0.1-11.65.2
curl: before 8.0.1-11.65.2
curl-debuginfo: before 8.0.1-11.65.2
libcurl-devel: before 8.0.1-11.65.2
curl-debugsource: before 8.0.1-11.65.2
External linkshttp://www.suse.com/support/update/announcement/2023/suse-su-20232225-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU76237
Risk: Medium
CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-28321
CWE-ID:
CWE-295 - Improper Certificate Validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to improper certificate validation when matching wildcards in TLS certificates for IDN names. A remote attacker crate a specially crafted certificate that will be considered trusted by the library.
Successful exploitation of the vulnerability requires that curl is built to use OpenSSL, Schannel or Gskit.
MitigationUpdate the affected package curl to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Software Development Kit 12: SP5
SUSE Linux Enterprise Server for SAP Applications 12: SP5
SUSE Linux Enterprise Server 12: SP5
SUSE Linux Enterprise High Performance Computing 12: SP5
libcurl4-debuginfo-32bit: before 8.0.1-11.65.2
libcurl4-32bit: before 8.0.1-11.65.2
libcurl4-debuginfo: before 8.0.1-11.65.2
libcurl4: before 8.0.1-11.65.2
curl: before 8.0.1-11.65.2
curl-debuginfo: before 8.0.1-11.65.2
libcurl-devel: before 8.0.1-11.65.2
curl-debugsource: before 8.0.1-11.65.2
External linkshttp://www.suse.com/support/update/announcement/2023/suse-su-20232225-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU76238
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-28322
CWE-ID:
CWE-440 - Expected Behavior Violation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a logic error when sending HTTP POST and PUT requests using the same handle. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. As a result, the application can misbehave and either send off the wrong data or use memory after free or similar in the second transfer.
MitigationUpdate the affected package curl to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Software Development Kit 12: SP5
SUSE Linux Enterprise Server for SAP Applications 12: SP5
SUSE Linux Enterprise Server 12: SP5
SUSE Linux Enterprise High Performance Computing 12: SP5
libcurl4-debuginfo-32bit: before 8.0.1-11.65.2
libcurl4-32bit: before 8.0.1-11.65.2
libcurl4-debuginfo: before 8.0.1-11.65.2
libcurl4: before 8.0.1-11.65.2
curl: before 8.0.1-11.65.2
curl-debuginfo: before 8.0.1-11.65.2
libcurl-devel: before 8.0.1-11.65.2
curl-debugsource: before 8.0.1-11.65.2
External linkshttp://www.suse.com/support/update/announcement/2023/suse-su-20232225-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.