Vulnerable Library - curlcurl-8_0_1

A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS. libcurl offers a myriad of powerful features

Library home page: https://github.com/curl/curl.git

Found in base branch: master

Vulnerable Source Files (1)

/lib/vssh/libssh2.c

Vulnerability Details

curl: CVE-2023-28319: UAF in SSH sha256 fingerprint check

Publish Date: 2023-03-14

URL: CVE-2023-28319

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2023-28319.html

Release Date: 2023-03-14

Fix Resolution: curl-8_1_0