Expected behavior violation in cURL - CVE-2023-28322

Vulnerability identifier: #VU76238

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28322

CWE-ID: CWE-440

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a logic error when sending HTTP POST and PUT requests using the same handle. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. As a result, the application can misbehave and either send off the wrong data or use memory after free or similar in the second transfer.

cURL
Event Streams
IBM Qradar SIEM
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
Telemetry Dashboard
Cloud Pak for Network Automation
Platform Automation Toolkit
Liquidware
IBM Engineering Requirements Management DOORS Next
SmartFabric OS10
webMethods Managed File Transfer
Citrix Workspace App
Webex App VDI
Storage Copy Data Management
Enterprise SONiC
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Watson Studio on Cloud Pak for Data
Storage Ceph
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect Client
Storage Protect for Virtual Environments: Data Protection for VMware
Total Storage Service Console (TSSC) / TS4500 IMC
IBM Sterling Order Management
Storage Protect Plus Server
EMC Cloud Tiering Appliance
Dell PowerProtect Cyber Recovery
Amazon Linux AMI
Gentoo Linux
Oracle Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
macOS
Oracle Solaris
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise Server 12 SP4 ESPOS
Slackware Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
openEuler
Fedora
Migration Toolkit for Runtimes
Service Telemetry Framework
Cryostat
IBM MQ Operator
Migration Toolkit for Virtualization
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Rational ClearCase
IBM QRadar WinCollect Agent
IBM Cloud Transformation Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
OpenShift Logging
IBM Safer Payments
App Connect Enterprise Certified Container
Red Hat Migration Toolkit for Applications
IBM Security Verify Governance
Red Hat OpenStack
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
VMware Horizon Client
Red Hat OpenShift GitOps
OpenShift Service Mesh
VMware Tanzu Operations Manager
OpenShift Virtualization
IBM Supplied MQ Advanced Queue Manager Container images
LANTIME Operating System Firmware (LTOS)
Juniper Secure Analytics (JSA)
Red Hat Single Sign-On
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libcurl3 (Ubuntu package)
libcurl4 (Ubuntu package)
libcurl3-nss (Ubuntu package)
libcurl3-gnutls (Ubuntu package)
curl (Ubuntu package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
curl
curl-debuginfo
libcurl4
libcurl4-debuginfo-32bit
curl-debugsource
libcurl4-32bit
libcurl4-debuginfo
libcurl4-32bit-debuginfo
libcurl-devel
curl (Red Hat package)
curl-minimal
libcurl
libcurl-minimal
curl-doc
curl-help
libcurl-devel-32bit
jbcs-httpd24-curl (Red Hat package)
net-misc/curl
Cisco Jabber
Cisco Webex Meetings
Network Observability plugin for the Openshift Console
JBoss Core Services
AMQ Broker
Industrial CyberSecurity for Linux Nodes
RecoverPoint for VMs
IBM Storage Scale System
Dell EMC VxRail Appliance
RSA Authentication Manager

Install updates from vendor's website.

cURL - update to 8.1.0
Dell EMC PowerProtect Data Protection - update to 2.7.8
Dell Data Protection Central - update to 19.10.0-4
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
Migration Toolkit for Runtimes - update to 1.2.5
Service Telemetry Framework - update to 1.5.4
Migration Toolkit for Containers - addressed in versions 1.7.15, 1.8.3
Red Hat OpenShift GitOps - addressed in versions 1.10.0, 1.10.4, 1.11, 1.11.3, 1.12.1
IBM MQ Operator - addressed in versions 2.0.21, 3.1.2
Migration Toolkit for Virtualization - update to 2.4.3
OpenShift Service Mesh - update to 2.5.1
Cloud Pak for Network Automation - update to 2.7.4
VMware Tanzu Operations Manager - update to 2.10.61
Isolation Segment - addressed in versions 2.11.40, 2.13.25, 3.0.18, 4.0.10
VMware Tanzu Application Service for VMs - addressed in versions 2.11.46, 2.13.28, 3.0.18, 4.0.10
Platform Automation Toolkit - addressed in versions 4.4.32, 5.0.25, 5.1.2
OpenShift Virtualization - update to 4.13.3
Red Hat OpenShift Container Platform - addressed in versions 4.12.58, 4.13.8
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
LANTIME Operating System Firmware (LTOS) - update to 7.08.002
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
Red Hat Single Sign-On - update to 7.6.8
IBM Rational ClearCase - addressed in versions 9.0.2.8, 9.1.0.5
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
IBM QRadar WinCollect Agent - update to 10.1.6
SmartFabric OS10 - addressed in versions 10.5.5.9, 10.5.6.1
Event Streams - update to 11.3.2
macOS - addressed in versions 11.7.9 20G1426, 12.6.8 21G725, 13.5 22G74
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
libcurl3 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libcurl4 (Ubuntu package) - addressed in versions Ubuntu Pro, 7.68.0-1ubuntu2.19, 7.81.0-1ubuntu1.11, 7.81.0-1ubuntu1.13, 7.85.0-1ubuntu0.6, 7.88.1-8ubuntu2.1
libcurl3-nss (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.68.0-1ubuntu2.19, 7.81.0-1ubuntu1.11, 7.81.0-1ubuntu1.13, 7.85.0-1ubuntu0.6, 7.88.1-8ubuntu2.1
libcurl3-gnutls (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.68.0-1ubuntu2.19, 7.81.0-1ubuntu1.11, 7.81.0-1ubuntu1.13, 7.85.0-1ubuntu0.6, 7.88.1-8ubuntu2.1
curl (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.68.0-1ubuntu2.19, 7.81.0-1ubuntu1.11, 7.81.0-1ubuntu1.13, 7.85.0-1ubuntu0.6, 7.88.1-8ubuntu2.1
jbcs-httpd24-mod_proxy_cluster (Red Hat package) - addressed in versions 1.3.19-4.el7jbcs, 1.3.19-4.el8jbcs
Network Observability plugin for the Openshift Console - update to 1.4.0
jbcs-httpd24-apr-util (Red Hat package) - addressed in versions 1.6.1-102.el7jbcs, 1.6.1-102.el8jbcs
jbcs-httpd24-apr (Red Hat package) - addressed in versions 1.7.0-8.el7jbcs, 1.7.0-8.el8jbcs
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.19-28.el7jbcs, 1.15.19-28.el8jbcs
Storage Copy Data Management - update to 2.2.24.0
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.4.0-25.el7jbcs, 2.4.0-25.el8jbcs
JBoss Core Services - update to 2.4.57
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.57-5.el7jbcs, 2.4.57-5.el8jbcs
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.3-29.el7jbcs, 2.9.3-29.el8jbcs
IBM Cloud Transformation Advisor - update to 3.10.0
Industrial CyberSecurity for Linux Nodes - update to 4.0.0.236
Enterprise SONiC - update to 4.2.1
DB2 on Cloud Pak for Data - update to 4.8.2
DB2 Warehouse on Cloud Pak for Data - update to 4.8.2
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.4
Watson Studio on Cloud Pak for Data - update to 5.0.3
OpenShift Logging - addressed in versions 5.6.18, 5.7.13
RecoverPoint for VMs - update to 6.0.SP1.P1
Storage Ceph - update to 6.1z2
IBM Storage Scale System - addressed in versions 6.1.2.9, 6.1.9.2
IBM Safer Payments - addressed in versions 6.4.2.05, 6.5.0.03, 6.6.0.01
App Connect Enterprise Certified Container - update to 7.0.0
Red Hat Migration Toolkit for Applications - update to 7.0.3
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
AMQ Broker - update to 7.12.0
curl - addressed in versions 7.60.0-4.56.1, 7.60.0-150000.51.1, 7.66.0-150200.4.57.1, 8.0.1-11.65.2, 8.0.1-150400.5.23.1
curl-debuginfo - addressed in versions 7.60.0-4.56.1, 7.60.0-150000.51.1, 7.66.0-150200.4.57.1, 8.0.1-11.65.2, 8.0.1-150400.5.23.1
libcurl4 - addressed in versions 7.60.0-4.56.1, 7.60.0-150000.51.1, 7.66.0-150200.4.57.1, 8.0.1-11.65.2, 8.0.1-150400.5.23.1
libcurl4-debuginfo-32bit - addressed in versions 7.60.0-4.56.1, 8.0.1-11.65.2
curl-debugsource - addressed in versions 7.60.0-4.56.1, 7.60.0-150000.51.1, 7.66.0-150200.4.57.1, 8.0.1-11.65.2, 8.0.1-150400.5.23.1
libcurl4-32bit - addressed in versions 7.60.0-4.56.1, 7.60.0-150000.51.1, 7.66.0-150200.4.57.1, 8.0.1-11.65.2, 8.0.1-150400.5.23.1
libcurl4-debuginfo - addressed in versions 7.60.0-4.56.1, 7.60.0-150000.51.1, 7.66.0-150200.4.57.1, 8.0.1-11.65.2, 8.0.1-150400.5.23.1
libcurl4-32bit-debuginfo - addressed in versions 7.60.0-150000.51.1, 7.66.0-150200.4.57.1, 8.0.1-150400.5.23.1
libcurl-devel - addressed in versions 7.60.0-150000.51.1, 7.66.0-150200.4.57.1, 8.0.1-11.65.2, 8.0.1-150400.5.23.1
curl (Red Hat package) - addressed in versions 7.61.1-30.el8_8.9, 7.61.1-33.el8_9.5, 7.76.1-14.el9_0.7, 7.76.1-23.el9_2.2
curl-minimal - update to 7.61.1-34.0.2
libcurl - update to 7.61.1-34.0.2
libcurl-devel - update to 7.61.1-34.0.2
libcurl-minimal - update to 7.61.1-34.0.2
curl-doc - update to 7.61.1-34.0.2
curl - update to 7.61.1-34.0.2
curl-debuginfo - update to 7.71.1-27
curl - update to 7.71.1-27
curl-debugsource - update to 7.71.1-27
libcurl - update to 7.71.1-27
libcurl-devel - update to 7.71.1-27
curl-help - update to 7.71.1-27
curl - addressed in versions 7.85.0-9.fc37, 8.0.1-2.fc38
curl - update to 8.0.1-1
libcurl-devel-32bit - update to 8.0.1-150400.5.23.1
Dell EMC VxRail Appliance - update to 8.0.101
curl - update to 8.1.0
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.23.0
Storage Protect Client - update to 8.1.23.0
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.23.0
jbcs-httpd24-curl (Red Hat package) - addressed in versions 8.2.1-1.el7jbcs, 8.2.1-1.el8jbcs
net-misc/curl - update to 8.3.0-r2
RSA Authentication Manager - addressed in versions 8.7 SP1 Patch 3, 8.7 SP2 Patch 1
IBM Supplied MQ Advanced Queue Manager Container images - addressed in versions 9.3.0.17-r1, 9.3.5.1-r1
Total Storage Service Console (TSSC) / TS4500 IMC - update to 9.4.31
IBM Security Verify Governance - update to 10.0.2.0.4
IBM Sterling Order Management - update to 10.0.2403.1
Storage Protect Plus Server - update to 10.1.16.3
EMC Cloud Tiering Appliance - addressed in versions 13.1.0.2.33, 13.2.0.2.24
Red Hat OpenStack - update to 16.2
Dell PowerProtect Cyber Recovery - update to 19.14.0.1

• https://curl.haxx.se/docs/CVE-2023-28322.html

• Multiple vulnerabilities in cURL
• SUSE update for curl
• SUSE update for curl
• SUSE update for curl
• SUSE update for curl
• SUSE update for curl
• Slackware Linux update for curl
• SUSE update for curl
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in App Connect Enterprise Certified Containe
• Ubuntu update for curl
• Ubuntu update for curl
• Multiple vulnerabilities in Apple macOS Ventura
• Multiple vulnerabilities in Apple macOS Monterey
• Multiple vulnerabilities in Apple macOS Big Sur
• Multiple vulnerabilities in IBM QRadar Wincollect
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Red Hat Enterprise Linux 9 update for curl
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat JBoss Core Services
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in OpenShift Virtualization 4.13
• Fedora 37 update for curl
• Fedora 38 update for curl
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Oracle Solaris third-party software
• Ubuntu update for curl
• Multiple vulnerabilities in Network Observability for OpenShift
• Red Hat Enterprise Linux 9.0 Extended Update Support update for curl
• Gentoo update for curl
• VMware Tanzu update for cURL
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.4
• IBM Safer Payments update for cURL
• Expected behavior violation in IBM Storage Ceph
• Dell Data Protection Central update for third-party components
• Red Hat Enterprise Linux 8.8 Extended Update Support update for curl
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Rational ClearCase
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• openEuler update for curl
• Multiple vulnerabilities in Service Telemetry Framework 1.5
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Red Hat Enterprise Linux 8 update for curl
• Expected behavior violation in IBM Storage Scale System
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.8
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh Containers 2.5
• Multiple vulnerabilities in Dell Networking OS10
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.10
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat build of Cryostat 2 on RHEL 8
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in Dell Enterprise SONiC Distribution
• Multiple vulnerabilities in Dell SmartFabric OS10
• Multiple vulnerabilities in OpenShift Logging 5.7
• Multiple vulnerabilities in OpenShift Logging 5.6
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in AMQ Broker 7.12
• Multiple vulnerabilities in Dell ThinOS
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM Storage Protect for Virtual Environments: Data Protection for Hyper-V
• Multiple vulnerabilities in IBM Storage Protect Client
• Multiple vulnerabilities in IBM Storage Protect for Virtual Environments: Data Protection for VMware
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Storage Protect Plus
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• IBM Event Streams update for cURL
• Multiple vulnerabilities in IBM Total Storage Service Console (TSSC) / TS4500 IMC
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Multiple vulnerabilities in IBM Watson Studio on Cloud Pak for Data - Execution Engine for Apache Hadoop
• Amazon Linux AMI update for curl
• Anolis OS update for curl
• PowerProtect Data Protection software update for third-party components
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in Meinberg LANTIME firmware (August 2023)
• Kaspersky Industrial CyberSecurity for Nodes update for cURL
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0