DEBIAN-CVE-2023-27536
- Source
- https://security-tracker.debian.org/tracker/CVE-2023-27536
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-27536.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2023-27536
- Upstream
- Downstream
- Published
- 2023-03-30T20:15:07Z
- Modified
- 2026-09-15T09:02:41Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.
- References
Affected packages
Debian:12 / curl
Package
- Name
- curl
- Purl
- pkg:deb/debian/curl?arch=source&distro=bookworm
Debian:13 / curl
Package
- Name
- curl
- Purl
- pkg:deb/debian/curl?arch=source&distro=trixie
Debian:14 / curl
Package
- Name
- curl
- Purl
- pkg:deb/debian/curl?arch=source&distro=forky