Amazon Linux AMI update for curl

Published: 2024-08-06

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-46219 CVE-2023-46218
CWE-ID	CWE-311 CWE-200
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Amazon Linux AMI Operating systems & Components / Operating system curl Operating systems & Components / Operating system package or component
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Missing Encryption of Sensitive Data

EUVDB-ID: #VU83899

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-46219

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error when handling HSTS long file names. When saving HSTS data to an excessively long file name, curl can end up removing all contents from the file, making subsequent requests using that file unaware of the HSTS status they should otherwise use. As a result, a remote attacker can perform MitM attack.

Mitigation

Update the affected packages:

aarch64:
    curl-minimal-debuginfo-8.5.0-1.amzn2023.0.1.aarch64
    curl-minimal-8.5.0-1.amzn2023.0.1.aarch64
    curl-debuginfo-8.5.0-1.amzn2023.0.1.aarch64
    libcurl-debuginfo-8.5.0-1.amzn2023.0.1.aarch64
    libcurl-minimal-8.5.0-1.amzn2023.0.1.aarch64
    libcurl-minimal-debuginfo-8.5.0-1.amzn2023.0.1.aarch64
    curl-debugsource-8.5.0-1.amzn2023.0.1.aarch64
    libcurl-8.5.0-1.amzn2023.0.1.aarch64
    curl-8.5.0-1.amzn2023.0.1.aarch64
    libcurl-devel-8.5.0-1.amzn2023.0.1.aarch64

src:
    curl-8.5.0-1.amzn2023.0.1.src

x86_64:
    curl-debuginfo-8.5.0-1.amzn2023.0.1.x86_64
    curl-minimal-debuginfo-8.5.0-1.amzn2023.0.1.x86_64
    libcurl-debuginfo-8.5.0-1.amzn2023.0.1.x86_64
    libcurl-minimal-debuginfo-8.5.0-1.amzn2023.0.1.x86_64
    curl-minimal-8.5.0-1.amzn2023.0.1.x86_64
    libcurl-8.5.0-1.amzn2023.0.1.x86_64
    libcurl-minimal-8.5.0-1.amzn2023.0.1.x86_64
    curl-8.5.0-1.amzn2023.0.1.x86_64
    libcurl-devel-8.5.0-1.amzn2023.0.1.x86_64
    curl-debugsource-8.5.0-1.amzn2023.0.1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

curl: before 8.5.0-1

CPE2.3

External links

https://alas.aws.amazon.com/AL2023/ALAS-2024-472.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU83900

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-46218

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor