cisco-sa-curl-libcurl-D9ds39cV

cURL and libcurl Vulnerability Affecting Cisco Products: October 2023

view advisory published 2023-10-12

On October 11, 2023, cURL released Version 8.4.0 of the cURL utility and the libcurl library. This release addressed two security vulnerabilities: CVE-2023-38545 – High Security Impact Rating (SIR) CVE-2023-38546 – Low SIR This advisory covers CVE-2023-38545 only. For more information about this vulnerability, see the cURL advisory ["https://curl.se/docs/CVE-2023-38545.html"].

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-38545US	critical9.8	78.7% (100th)	Exploit	2023-10-18
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the ad…

references

External citations — patches, advisories, analysis.

Security Vulnerability Policyexternal
cURL advisoryexternal
cURL and libcurl Vulnerability Affecting Cisco Products: October 2023self
Cisco Security Vulnerability Policyexternal
considering software upgradesexternal
Cisco Security Advisoriesexternal

remediations (3)

FixedCisco Crosswork Network Change Automation
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Network Analytics
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan