CVE-2023-27538

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

Database specific

{
    "cna_assigner": "hackerone",
    "cwe_ids": [
        "CWE-305"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27538.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "Fixed in 8.0.0"
                },
                {
                    "last_affected": "Fixed in 8.0.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/curl/curl

Affected ranges

Type

GIT

Repo

https://github.com/curl/curl

Events

Introduced

ef442d58039106eee596d09dd47e2bd6aa1ec032

Fixed

741b214c095c688961ac847e86babfd68299e4ce

Database specific

Show details

{
    "cpe": "cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.16.1"
        },
        {
            "fixed": "8.0.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-27538.json"