CVE-2023-27537

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "Fixed in 8.0.0"
                },
                {
                    "last_affected": "Fixed in 8.0.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27537.json",
    "cna_assigner": "hackerone",
    "cwe_ids": [
        "CWE-415"
    ]
}

References

Affected packages

Git / github.com/curl/curl

Affected ranges

Type

GIT

Repo

https://github.com/curl/curl

Events

Introduced

3027611ca6d4cc5510d2d0fccc3e5a074e09a2fb

Last affected

046209e561b7e9b5aab1aef7daebf29ee6e6e8c7

Database specific

{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:haxx:libcurl:7.88.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:libcurl:7.88.1:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "7.88.0"
        },
        {
            "last_affected": "7.88.0"
        },
        {
            "introduced": "7.88.1"
        },
        {
            "last_affected": "7.88.1"
        }
    ]
}

Affected versions

7.*

7.88.0

7.88.1

Other

curl-7_88_0

curl-7_88_1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-27537.json"