VMware Tanzu products update for curl
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538 |
| CWE-ID | CWE-20 CWE-371 CWE-200 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
VMware Tanzu Application Service for VMs Server applications / Other server solutions Isolation Segment Server applications / Other server solutions Platform Automation Toolkit Other software / Other software solutions VMware Tanzu Operations Manager Server applications / Virtualization software |
| Vendor | VMware, Inc |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Input validation error
EUVDB-ID: #VU73826
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-27533
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to manipulate requests.
The vulnerability exists due to missing documentation of the TELNET protocol support and the ability to pass on user name and "telnet options" for the server negotiation. A remote attacker can manipulate the connection sending unexpected data to the server via the affected client.
Install updates from vendor's website.
Vulnerable software versionsVMware Tanzu Application Service for VMs: All versions
Isolation Segment: All versions
Platform Automation Toolkit: before 4.4.31
VMware Tanzu Operations Manager: before
CPE2.3- cpe:2.3:a:vmware:vmware_tanzu_application_service_for_vms:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:isolation_segment:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:platform_automation_toolkit:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_tanzu_operations_manager:*:*:*:*:*:*:*:*
https://tanzu.vmware.com/security/usn-5964-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU73827
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-27534
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in the SFTP support when handling the tilde "~" character in the filepath. cURL will replace the tilde character to the current user's home directory and can reveal otherwise restricted files.
Install updates from vendor's website.
Vulnerable software versionsVMware Tanzu Application Service for VMs: All versions
Isolation Segment: All versions
Platform Automation Toolkit: before 4.4.31
VMware Tanzu Operations Manager: before
CPE2.3- cpe:2.3:a:vmware:platform_automation_toolkit:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_tanzu_operations_manager:*:*:*:*:*:*:*:*
https://tanzu.vmware.com/security/usn-5964-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) State Issues
EUVDB-ID: #VU73828
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-27535
CWE-ID:
CWE-371 - State Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to FTP server.
The vulnerability exists due to cURL will reuse a previously created FTP connection even when one or more options had been changed that could have made the effective user a very different one. A remote attacker can connect to the FTP server using credentials supplied by another user and gain access to otherwise restricted functionality.
The settings in questions are CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC and CURLOPT_USE_SSL level.
Install updates from vendor's website.
Vulnerable software versionsVMware Tanzu Application Service for VMs: All versions
Isolation Segment: All versions
Platform Automation Toolkit: before 4.4.31
VMware Tanzu Operations Manager: before
CPE2.3- cpe:2.3:a:vmware:platform_automation_toolkit:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_tanzu_operations_manager:*:*:*:*:*:*:*:*
https://tanzu.vmware.com/security/usn-5964-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) State Issues
EUVDB-ID: #VU73829
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-27536
CWE-ID:
CWE-371 - State Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to cURL will reuse a previously created connection even when the GSS delegation (CURLOPT_GSSAPI_DELEGATION) option had been changed that could have changed the user's permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers.
MitigationInstall updates from vendor's website.
Vulnerable software versionsVMware Tanzu Application Service for VMs: All versions
Isolation Segment: All versions
Platform Automation Toolkit: before 4.4.31
VMware Tanzu Operations Manager: before
CPE2.3- cpe:2.3:a:vmware:platform_automation_toolkit:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_tanzu_operations_manager:*:*:*:*:*:*:*:*
https://tanzu.vmware.com/security/usn-5964-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Information disclosure
EUVDB-ID: #VU73831
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-27538
CWE-ID:
CWE-200 - Exposure of sensitive information to an unauthorized actor
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the way libcurl handles previously used connections in a connection pool for subsequent transfers. Several SSH settings were left out from the configuration match checks, resulting in erroneous matches for different resources. As a result, libcurl can send authentication string from one resource to another, exposing credentials to a third-party. MitigationInstall updates from vendor's website.
Vulnerable software versionsVMware Tanzu Application Service for VMs: All versions
Isolation Segment: All versions
Platform Automation Toolkit: before 4.4.31
VMware Tanzu Operations Manager: before
CPE2.3- cpe:2.3:a:vmware:platform_automation_toolkit:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_tanzu_operations_manager:*:*:*:*:*:*:*:*
https://tanzu.vmware.com/security/usn-5964-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
