CVE-2023-23915

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-23915
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-23915.json
Aliases
Related
Published
2023-02-23T20:15:13Z
Modified
2024-05-14T12:44:07.606324Z
Summary
[none]
Details

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then not get upgraded properly to HSTS.

References

Affected packages

Alpine:v3.14 / curl

Package

Name
curl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
7.79.1-r5

Affected versions

7.*

7.19.2-r0
7.19.2-r1
7.19.4-r0
7.19.5-r0
7.19.6-r0
7.19.7-r0
7.19.7-r1
7.20.1-r0
7.20.1-r1
7.21.0-r0
7.21.1-r0
7.21.2-r0
7.21.3-r0
7.21.3-r1
7.21.4-r0
7.21.4-r1
7.21.5-r0
7.21.5-r1
7.21.6-r0
7.21.7-r0
7.21.7-r1
7.21.7-r2
7.22.0-r0
7.23.1-r0
7.24.0-r0
7.25.0-r0
7.26.0-r0
7.27.0-r0
7.27.0-r1
7.28.0-r0
7.28.1-r0
7.29.0-r0
7.30.0-r0
7.31.0-r0
7.32.0-r0
7.33.0-r0
7.33.0-r1
7.34.0-r0
7.34.0-r1
7.35.0-r0
7.36.0-r0
7.37.0-r0
7.37.1-r0
7.38.0-r0
7.39.0-r0
7.40.0-r0
7.41.0-r0
7.42.0-r0
7.42.1-r0
7.42.1-r1
7.43.0-r0
7.44.0-r0
7.45.0-r0
7.45.0-r1
7.46.0-r0
7.46.0-r1
7.46.0-r2
7.47.0-r0
7.47.1-r0
7.48.0-r0
7.49.0-r0
7.49.1-r0
7.50.0-r0
7.50.1-r0
7.50.2-r0
7.50.3-r0
7.50.3-r1
7.51.0-r0
7.51.0-r1
7.52.0-r0
7.52.1-r0
7.52.1-r1
7.53.0-r0
7.53.1-r0
7.53.1-r1
7.53.1-r2
7.53.1-r3
7.54.0-r0
7.54.1-r0
7.55.0-r0
7.55.1-r0
7.56.0-r0
7.56.1-r0
7.56.1-r1
7.57.0-r0
7.58.0-r0
7.58.0-r1
7.58.0-r2
7.59.0-r0
7.59.0-r1
7.60.0-r0
7.60.0-r1
7.61.0-r0
7.61.1-r0
7.62.0-r0
7.62.0-r1
7.62.0-r2
7.63.0-r0
7.64.0-r0
7.64.0-r1
7.64.1-r0
7.64.1-r1
7.64.1-r2
7.64.1-r3
7.65.0-r0
7.65.1-r0
7.65.3-r0
7.66.0-r0
7.67.0-r0
7.68.0-r0
7.69.0-r0
7.69.0-r1
7.69.1-r0
7.70.0-r0
7.70.0-r1
7.70.0-r2
7.71.0-r0
7.71.0-r1
7.71.1-r0
7.72.0-r0
7.73.0-r0
7.74.0-r0
7.75.0-r0
7.76.0-r0
7.76.1-r0
7.77.0-r0
7.77.0-r1
7.78.0-r0
7.79.0-r0
7.79.1-r0
7.79.1-r1
7.79.1-r2
7.79.1-r3
7.79.1-r4

Alpine:v3.15 / curl

Package

Name
curl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
7.80.0-r6

Affected versions

7.*

7.19.2-r0
7.19.2-r1
7.19.4-r0
7.19.5-r0
7.19.6-r0
7.19.7-r0
7.19.7-r1
7.20.1-r0
7.20.1-r1
7.21.0-r0
7.21.1-r0
7.21.2-r0
7.21.3-r0
7.21.3-r1
7.21.4-r0
7.21.4-r1
7.21.5-r0
7.21.5-r1
7.21.6-r0
7.21.7-r0
7.21.7-r1
7.21.7-r2
7.22.0-r0
7.23.1-r0
7.24.0-r0
7.25.0-r0
7.26.0-r0
7.27.0-r0
7.27.0-r1
7.28.0-r0
7.28.1-r0
7.29.0-r0
7.30.0-r0
7.31.0-r0
7.32.0-r0
7.33.0-r0
7.33.0-r1
7.34.0-r0
7.34.0-r1
7.35.0-r0
7.36.0-r0
7.37.0-r0
7.37.1-r0
7.38.0-r0
7.39.0-r0
7.40.0-r0
7.41.0-r0
7.42.0-r0
7.42.1-r0
7.42.1-r1
7.43.0-r0
7.44.0-r0
7.45.0-r0
7.45.0-r1
7.46.0-r0
7.46.0-r1
7.46.0-r2
7.47.0-r0
7.47.1-r0
7.48.0-r0
7.49.0-r0
7.49.1-r0
7.50.0-r0
7.50.1-r0
7.50.2-r0
7.50.3-r0
7.50.3-r1
7.51.0-r0
7.51.0-r1
7.52.0-r0
7.52.1-r0
7.52.1-r1
7.53.0-r0
7.53.1-r0
7.53.1-r1
7.53.1-r2
7.53.1-r3
7.54.0-r0
7.54.1-r0
7.55.0-r0
7.55.1-r0
7.56.0-r0
7.56.1-r0
7.56.1-r1
7.57.0-r0
7.58.0-r0
7.58.0-r1
7.58.0-r2
7.59.0-r0
7.59.0-r1
7.60.0-r0
7.60.0-r1
7.61.0-r0
7.61.1-r0
7.62.0-r0
7.62.0-r1
7.62.0-r2
7.63.0-r0
7.64.0-r0
7.64.0-r1
7.64.1-r0
7.64.1-r1
7.64.1-r2
7.64.1-r3
7.65.0-r0
7.65.1-r0
7.65.3-r0
7.66.0-r0
7.67.0-r0
7.68.0-r0
7.69.0-r0
7.69.0-r1
7.69.1-r0
7.70.0-r0
7.70.0-r1
7.70.0-r2
7.71.0-r0
7.71.0-r1
7.71.1-r0
7.72.0-r0
7.73.0-r0
7.74.0-r0
7.75.0-r0
7.76.0-r0
7.76.1-r0
7.77.0-r0
7.77.0-r1
7.78.0-r0
7.78.0-r1
7.78.0-r2
7.79.0-r0
7.79.1-r0
7.80.0-r0
7.80.0-r1
7.80.0-r2
7.80.0-r3
7.80.0-r4
7.80.0-r5

Alpine:v3.16 / curl

Package

Name
curl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
7.83.1-r6

Affected versions

7.*

7.19.2-r0
7.19.2-r1
7.19.4-r0
7.19.5-r0
7.19.6-r0
7.19.7-r0
7.19.7-r1
7.20.1-r0
7.20.1-r1
7.21.0-r0
7.21.1-r0
7.21.2-r0
7.21.3-r0
7.21.3-r1
7.21.4-r0
7.21.4-r1
7.21.5-r0
7.21.5-r1
7.21.6-r0
7.21.7-r0
7.21.7-r1
7.21.7-r2
7.22.0-r0
7.23.1-r0
7.24.0-r0
7.25.0-r0
7.26.0-r0
7.27.0-r0
7.27.0-r1
7.28.0-r0
7.28.1-r0
7.29.0-r0
7.30.0-r0
7.31.0-r0
7.32.0-r0
7.33.0-r0
7.33.0-r1
7.34.0-r0
7.34.0-r1
7.35.0-r0
7.36.0-r0
7.37.0-r0
7.37.1-r0
7.38.0-r0
7.39.0-r0
7.40.0-r0
7.41.0-r0
7.42.0-r0
7.42.1-r0
7.42.1-r1
7.43.0-r0
7.44.0-r0
7.45.0-r0
7.45.0-r1
7.46.0-r0
7.46.0-r1
7.46.0-r2
7.47.0-r0
7.47.1-r0
7.48.0-r0
7.49.0-r0
7.49.1-r0
7.50.0-r0
7.50.1-r0
7.50.2-r0
7.50.3-r0
7.50.3-r1
7.51.0-r0
7.51.0-r1
7.52.0-r0
7.52.1-r0
7.52.1-r1
7.53.0-r0
7.53.1-r0
7.53.1-r1
7.53.1-r2
7.53.1-r3
7.54.0-r0
7.54.1-r0
7.55.0-r0
7.55.1-r0
7.56.0-r0
7.56.1-r0
7.56.1-r1
7.57.0-r0
7.58.0-r0
7.58.0-r1
7.58.0-r2
7.59.0-r0
7.59.0-r1
7.60.0-r0
7.60.0-r1
7.61.0-r0
7.61.1-r0
7.62.0-r0
7.62.0-r1
7.62.0-r2
7.63.0-r0
7.64.0-r0
7.64.0-r1
7.64.1-r0
7.64.1-r1
7.64.1-r2
7.64.1-r3
7.65.0-r0
7.65.1-r0
7.65.3-r0
7.66.0-r0
7.67.0-r0
7.68.0-r0
7.69.0-r0
7.69.0-r1
7.69.1-r0
7.70.0-r0
7.70.0-r1
7.70.0-r2
7.71.0-r0
7.71.0-r1
7.71.1-r0
7.72.0-r0
7.73.0-r0
7.74.0-r0
7.75.0-r0
7.76.0-r0
7.76.1-r0
7.77.0-r0
7.77.0-r1
7.78.0-r0
7.78.0-r1
7.78.0-r2
7.79.0-r0
7.79.1-r0
7.80.0-r0
7.81.0-r0
7.81.0-r1
7.82.0-r0
7.82.0-r1
7.83.0-r0
7.83.1-r0
7.83.1-r1
7.83.1-r2
7.83.1-r3
7.83.1-r4
7.83.1-r5

Alpine:v3.17 / curl

Package

Name
curl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
7.87.0-r2

Affected versions

7.*

7.19.2-r0
7.19.2-r1
7.19.4-r0
7.19.5-r0
7.19.6-r0
7.19.7-r0
7.19.7-r1
7.20.1-r0
7.20.1-r1
7.21.0-r0
7.21.1-r0
7.21.2-r0
7.21.3-r0
7.21.3-r1
7.21.4-r0
7.21.4-r1
7.21.5-r0
7.21.5-r1
7.21.6-r0
7.21.7-r0
7.21.7-r1
7.21.7-r2
7.22.0-r0
7.23.1-r0
7.24.0-r0
7.25.0-r0
7.26.0-r0
7.27.0-r0
7.27.0-r1
7.28.0-r0
7.28.1-r0
7.29.0-r0
7.30.0-r0
7.31.0-r0
7.32.0-r0
7.33.0-r0
7.33.0-r1
7.34.0-r0
7.34.0-r1
7.35.0-r0
7.36.0-r0
7.37.0-r0
7.37.1-r0
7.38.0-r0
7.39.0-r0
7.40.0-r0
7.41.0-r0
7.42.0-r0
7.42.1-r0
7.42.1-r1
7.43.0-r0
7.44.0-r0
7.45.0-r0
7.45.0-r1
7.46.0-r0
7.46.0-r1
7.46.0-r2
7.47.0-r0
7.47.1-r0
7.48.0-r0
7.49.0-r0
7.49.1-r0
7.50.0-r0
7.50.1-r0
7.50.2-r0
7.50.3-r0
7.50.3-r1
7.51.0-r0
7.51.0-r1
7.52.0-r0
7.52.1-r0
7.52.1-r1
7.53.0-r0
7.53.1-r0
7.53.1-r1
7.53.1-r2
7.53.1-r3
7.54.0-r0
7.54.1-r0
7.55.0-r0
7.55.1-r0
7.56.0-r0
7.56.1-r0
7.56.1-r1
7.57.0-r0
7.58.0-r0
7.58.0-r1
7.58.0-r2
7.59.0-r0
7.59.0-r1
7.60.0-r0
7.60.0-r1
7.61.0-r0
7.61.1-r0
7.62.0-r0
7.62.0-r1
7.62.0-r2
7.63.0-r0
7.64.0-r0
7.64.0-r1
7.64.1-r0
7.64.1-r1
7.64.1-r2
7.64.1-r3
7.65.0-r0
7.65.1-r0
7.65.3-r0
7.66.0-r0
7.67.0-r0
7.68.0-r0
7.69.0-r0
7.69.0-r1
7.69.1-r0
7.70.0-r0
7.70.0-r1
7.70.0-r2
7.71.0-r0
7.71.0-r1
7.71.1-r0
7.72.0-r0
7.73.0-r0
7.74.0-r0
7.75.0-r0
7.76.0-r0
7.76.1-r0
7.77.0-r0
7.77.0-r1
7.78.0-r0
7.78.0-r1
7.78.0-r2
7.79.0-r0
7.79.1-r0
7.80.0-r0
7.81.0-r0
7.81.0-r1
7.82.0-r0
7.82.0-r1
7.83.0-r0
7.83.1-r0
7.83.1-r1
7.84.0-r0
7.84.0-r1
7.84.0-r2
7.85.0-r0
7.86.0-r0
7.86.0-r1
7.87.0-r0
7.87.0-r1

Alpine:v3.18 / curl

Package

Name
curl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
7.88.0-r0

Affected versions

7.*

7.19.2-r0
7.19.2-r1
7.19.4-r0
7.19.5-r0
7.19.6-r0
7.19.7-r0
7.19.7-r1
7.20.1-r0
7.20.1-r1
7.21.0-r0
7.21.1-r0
7.21.2-r0
7.21.3-r0
7.21.3-r1
7.21.4-r0
7.21.4-r1
7.21.5-r0
7.21.5-r1
7.21.6-r0
7.21.7-r0
7.21.7-r1
7.21.7-r2
7.22.0-r0
7.23.1-r0
7.24.0-r0
7.25.0-r0
7.26.0-r0
7.27.0-r0
7.27.0-r1
7.28.0-r0
7.28.1-r0
7.29.0-r0
7.30.0-r0
7.31.0-r0
7.32.0-r0
7.33.0-r0
7.33.0-r1
7.34.0-r0
7.34.0-r1
7.35.0-r0
7.36.0-r0
7.37.0-r0
7.37.1-r0
7.38.0-r0
7.39.0-r0
7.40.0-r0
7.41.0-r0
7.42.0-r0
7.42.1-r0
7.42.1-r1
7.43.0-r0
7.44.0-r0
7.45.0-r0
7.45.0-r1
7.46.0-r0
7.46.0-r1
7.46.0-r2
7.47.0-r0
7.47.1-r0
7.48.0-r0
7.49.0-r0
7.49.1-r0
7.50.0-r0
7.50.1-r0
7.50.2-r0
7.50.3-r0
7.50.3-r1
7.51.0-r0
7.51.0-r1
7.52.0-r0
7.52.1-r0
7.52.1-r1
7.53.0-r0
7.53.1-r0
7.53.1-r1
7.53.1-r2
7.53.1-r3
7.54.0-r0
7.54.1-r0
7.55.0-r0
7.55.1-r0
7.56.0-r0
7.56.1-r0
7.56.1-r1
7.57.0-r0
7.58.0-r0
7.58.0-r1
7.58.0-r2
7.59.0-r0
7.59.0-r1
7.60.0-r0
7.60.0-r1
7.61.0-r0
7.61.1-r0
7.62.0-r0
7.62.0-r1
7.62.0-r2
7.63.0-r0
7.64.0-r0
7.64.0-r1
7.64.1-r0
7.64.1-r1
7.64.1-r2
7.64.1-r3
7.65.0-r0
7.65.1-r0
7.65.3-r0
7.66.0-r0
7.67.0-r0
7.68.0-r0
7.69.0-r0
7.69.0-r1
7.69.1-r0
7.70.0-r0
7.70.0-r1
7.70.0-r2
7.71.0-r0
7.71.0-r1
7.71.1-r0
7.72.0-r0
7.73.0-r0
7.74.0-r0
7.75.0-r0
7.76.0-r0
7.76.1-r0
7.77.0-r0
7.77.0-r1
7.78.0-r0
7.78.0-r1
7.78.0-r2
7.79.0-r0
7.79.1-r0
7.80.0-r0
7.81.0-r0
7.81.0-r1
7.82.0-r0
7.82.0-r1
7.83.0-r0
7.83.1-r0
7.83.1-r1
7.84.0-r0
7.84.0-r1
7.84.0-r2
7.85.0-r0
7.86.0-r0
7.86.0-r1
7.87.0-r0
7.87.0-r1
7.87.0-r2
7.87.0-r3

Alpine:v3.19 / curl

Package

Name
curl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
7.88.0-r0

Affected versions

7.*

7.19.2-r0
7.19.2-r1
7.19.4-r0
7.19.5-r0
7.19.6-r0
7.19.7-r0
7.19.7-r1
7.20.1-r0
7.20.1-r1
7.21.0-r0
7.21.1-r0
7.21.2-r0
7.21.3-r0
7.21.3-r1
7.21.4-r0
7.21.4-r1
7.21.5-r0
7.21.5-r1
7.21.6-r0
7.21.7-r0
7.21.7-r1
7.21.7-r2
7.22.0-r0
7.23.1-r0
7.24.0-r0
7.25.0-r0
7.26.0-r0
7.27.0-r0
7.27.0-r1
7.28.0-r0
7.28.1-r0
7.29.0-r0
7.30.0-r0
7.31.0-r0
7.32.0-r0
7.33.0-r0
7.33.0-r1
7.34.0-r0
7.34.0-r1
7.35.0-r0
7.36.0-r0
7.37.0-r0
7.37.1-r0
7.38.0-r0
7.39.0-r0
7.40.0-r0
7.41.0-r0
7.42.0-r0
7.42.1-r0
7.42.1-r1
7.43.0-r0
7.44.0-r0
7.45.0-r0
7.45.0-r1
7.46.0-r0
7.46.0-r1
7.46.0-r2
7.47.0-r0
7.47.1-r0
7.48.0-r0
7.49.0-r0
7.49.1-r0
7.50.0-r0
7.50.1-r0
7.50.2-r0
7.50.3-r0
7.50.3-r1
7.51.0-r0
7.51.0-r1
7.52.0-r0
7.52.1-r0
7.52.1-r1
7.53.0-r0
7.53.1-r0
7.53.1-r1
7.53.1-r2
7.53.1-r3
7.54.0-r0
7.54.1-r0
7.55.0-r0
7.55.1-r0
7.56.0-r0
7.56.1-r0
7.56.1-r1
7.57.0-r0
7.58.0-r0
7.58.0-r1
7.58.0-r2
7.59.0-r0
7.59.0-r1
7.60.0-r0
7.60.0-r1
7.61.0-r0
7.61.1-r0
7.62.0-r0
7.62.0-r1
7.62.0-r2
7.63.0-r0
7.64.0-r0
7.64.0-r1
7.64.1-r0
7.64.1-r1
7.64.1-r2
7.64.1-r3
7.65.0-r0
7.65.1-r0
7.65.3-r0
7.66.0-r0
7.67.0-r0
7.68.0-r0
7.69.0-r0
7.69.0-r1
7.69.1-r0
7.70.0-r0
7.70.0-r1
7.70.0-r2
7.71.0-r0
7.71.0-r1
7.71.1-r0
7.72.0-r0
7.73.0-r0
7.74.0-r0
7.75.0-r0
7.76.0-r0
7.76.1-r0
7.77.0-r0
7.77.0-r1
7.78.0-r0
7.78.0-r1
7.78.0-r2
7.79.0-r0
7.79.1-r0
7.80.0-r0
7.81.0-r0
7.81.0-r1
7.82.0-r0
7.82.0-r1
7.83.0-r0
7.83.1-r0
7.83.1-r1
7.84.0-r0
7.84.0-r1
7.84.0-r2
7.85.0-r0
7.86.0-r0
7.86.0-r1
7.87.0-r0
7.87.0-r1
7.87.0-r2
7.87.0-r3

Git / github.com/curl/curl

Affected ranges

Type
GIT
Repo
https://github.com/curl/curl
Events
Introduced
6b951a6928811507d493303b2878e848c077b471
Introduced
98044e81705dc24a56daaf3544f30c13f0fc3a31
Fixed
3027611ca6d4cc5510d2d0fccc3e5a074e09a2fb

Affected versions

Other

curl-7_77_0
curl-7_78_0
curl-7_79_0
curl-7_79_1
curl-7_80_0
curl-7_81_0
curl-7_82_0
curl-7_83_0
curl-7_83_1
curl-7_84_0
curl-7_85_0
curl-7_86_0
curl-7_87_0