Bugzilla – Bug 1209211
VUL-0: CVE-2023-27535: curl: FTP too eager connection reuse
Last modified: 2024-04-15 15:01:16 UTC
CVE-2023-27535: FTP too eager connection reuse ============================================== Project curl Security Advisory, March 20th 2023 - [Permalink](https://curl.se/docs/CVE-2023-27535.html) VULNERABILITY ------------- libcurl would reuse a previously created FTP connection even when or more options had been changed that could have made the effective user a very different one, thus leading to the doing the second transfer with wrong credentials. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The settings in questions are `CURLOPT_FTP_ACCOUNT`, `CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL` level. We are not aware of any exploit of this flaw. INFO ---- CVE-2023-27535 was introduced in [commit 177dbc7be07125582](https://github.com/curl/curl/commit/177dbc7be07125582), shipped in curl 7.13.0. CWE-305: Authentication Bypass by Primary Weakness Severity: Medium AFFECTED VERSIONS ----------------- - Affected versions: curl 7.13.0 to and including 7.88.1 - Not affected versions: curl < 7.13.0 and curl >= 8.0.0 libcurl is used by many applications, but not always advertised as such! THE SOLUTION ------------ A [fix for CVE-2023-27535](https://github.com/curl/curl/commit/8f4608468b890dc) RECOMMENDATIONS -------------- A - Upgrade curl to version 8.0.0 B - Apply the patch to your local version TIMELINE -------- This issue was reported to the curl project on March 5, 2023. We contacted distros@openwall on March 13, 2023. curl 8.0.0 was released on March 20 2023, coordinated with the publication of this advisory. CREDITS ------- - Reported-by: Harry Sintonen - Patched-by: Daniel Stenberg
(In reply to Carlos López from comment #0) > AFFECTED VERSIONS > ----------------- > > - Affected versions: curl 7.13.0 to and including 7.88.1 > - Not affected versions: curl < 7.13.0 and curl >= 8.0.0 This should affect all versions we support: - SUSE:SLE-11-SP3:Update - SUSE:SLE-12:Update - SUSE:SLE-12-SP4:Update (LTSS) - SUSE:SLE-12-SP5:Update - SUSE:SLE-15:Update (LTSS) - SUSE:SLE-15-SP2:Update - SUSE:SLE-15-SP4:Update - openSUSE:Factory Lowest version is on SLE-11-SP3:Update (7.37.0).
Public: https://www.openwall.com/lists/oss-security/2023/03/20/3
Factory submission: https://build.opensuse.org/request/show/1073051 Assigning back to security-team.
SUSE-SU-2023:0865-1: An update that solves five vulnerabilities can now be installed. Category: security (moderate) Bug References: 1209209, 1209210, 1209211, 1209212, 1209214 CVE References: CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536, CVE-2023-27538 Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): curl-7.60.0-11.60.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): curl-7.60.0-11.60.1 SUSE Linux Enterprise Server 12 SP5 (src): curl-7.60.0-11.60.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): curl-7.60.0-11.60.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:1582-1: An update that solves five vulnerabilities can now be installed. Category: security (moderate) Bug References: 1209209, 1209210, 1209211, 1209212, 1209214 CVE References: CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536, CVE-2023-27538 Sources used: openSUSE Leap Micro 5.3 (src): curl-7.79.1-150400.5.18.1 openSUSE Leap 15.4 (src): curl-7.79.1-150400.5.18.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): curl-7.79.1-150400.5.18.1 SUSE Linux Enterprise Micro 5.3 (src): curl-7.79.1-150400.5.18.1 Basesystem Module 15-SP4 (src): curl-7.79.1-150400.5.18.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:1711-1: An update that solves six vulnerabilities can now be installed. Category: security (moderate) Bug References: 1207992, 1209209, 1209210, 1209211, 1209212, 1209214 CVE References: CVE-2023-23916, CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536, CVE-2023-27538 Sources used: SUSE Linux Enterprise Real Time 15 SP3 (src): curl-7.66.0-150200.4.52.1 SUSE Linux Enterprise Micro 5.1 (src): curl-7.66.0-150200.4.52.1 SUSE Linux Enterprise Micro 5.2 (src): curl-7.66.0-150200.4.52.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): curl-7.66.0-150200.4.52.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:2226-1: An update that solves 10 vulnerabilities and has one fix can now be installed. Category: security (important) Bug References: 1206309, 1207992, 1209209, 1209210, 1209211, 1209212, 1209214, 1211231, 1211232, 1211233, 1211339 CVE References: CVE-2022-43552, CVE-2023-23916, CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536, CVE-2023-27538, CVE-2023-28320, CVE-2023-28321, CVE-2023-28322 Sources used: SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): curl-7.60.0-150000.51.1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): curl-7.60.0-150000.51.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): curl-7.60.0-150000.51.1 SUSE Enterprise Storage 6 (src): curl-7.60.0-150000.51.1 SUSE CaaS Platform 4.0 (src): curl-7.60.0-150000.51.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:2228-1: An update that solves 10 vulnerabilities and has one fix can now be installed. Category: security (important) Bug References: 1206309, 1207992, 1209209, 1209210, 1209211, 1209212, 1209214, 1211231, 1211232, 1211233, 1211339 CVE References: CVE-2022-43552, CVE-2023-23916, CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536, CVE-2023-27538, CVE-2023-28320, CVE-2023-28321, CVE-2023-28322 Sources used: SUSE OpenStack Cloud 9 (src): curl-7.60.0-4.56.1 SUSE OpenStack Cloud Crowbar 9 (src): curl-7.60.0-4.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4 (src): curl-7.60.0-4.56.1 SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (src): curl-7.60.0-4.56.1 SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (src): curl-7.60.0-4.56.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done