Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update: curl #1178

Closed
dongsupark opened this issue Sep 15, 2023 · 0 comments · Fixed by flatcar/scripts#1177
Closed

update: curl #1178

dongsupark opened this issue Sep 15, 2023 · 0 comments · Fixed by flatcar/scripts#1177
Labels
advisory security advisory cvss/HIGH > 7 && < 9 assessed CVSS security security concerns

Comments

@dongsupark
Copy link
Member

dongsupark commented Sep 15, 2023

Name: curl
CVEs: CVE-2023-38039
CVSSs: 7.5
Action Needed: update to >= 8.3.0

Summary: When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

See also https://seclists.org/oss-sec/2023/q3/175.

refmap.gentoo: https://bugs.gentoo.org/914091

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
advisory security advisory cvss/HIGH > 7 && < 9 assessed CVSS security security concerns
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant