NetSight
IP …
low3.7

CVE-2023-28322

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNC…

Impact

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Affected products

VendorProductAffected versions
HaxxCurl
before 8.1.0
FedoraprojectFedora
Versions 37, 38
AppleMacos
from 11.0 before 11.7.9
from 12.0 before 12.6.8
from 13.0 before 13.5
NetappClustered Data Ontap
All versions
NetappOntap Antivirus Connector
All versions
NetappH300s Firmware
All versions
NetappH500s Firmware
All versions
NetappH700s Firmware
All versions
NetappH410s Firmware
All versions

Weakness classification

CWE-200

References