CVE-2023-28322
Fixed in a distro release EPSS 2%CVSS 5.3
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.
Products: haxx curl, fedoraproject fedora, apple macos, netapp clustered_data_ontap, netapp ontap_antivirus_connector, netapp h300s_firmware, netapp h500s_firmware, netapp h700s_firmware, netapp h410s_firmware
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | curl | 7.61.1-33.el8_9.5 |
| AlmaLinux 8 | libcurl | 7.61.1-33.el8_9.5 |
| AlmaLinux 8 | libcurl-devel | 7.61.1-33.el8_9.5 |
| AlmaLinux 8 | libcurl-minimal | 7.61.1-33.el8_9.5 |
| AlmaLinux 9 | curl | 7.76.1-23.el9_2.2 |
| AlmaLinux 9 | curl-minimal | 7.76.1-23.el9_2.2 |
| AlmaLinux 9 | libcurl | 7.76.1-23.el9_2.2 |
| AlmaLinux 9 | libcurl-devel | 7.76.1-23.el9_2.2 |
| AlmaLinux 9 | libcurl-minimal | 7.76.1-23.el9_2.2 |
| Alpine 3.15 | curl | 8.1.0-r0 |
| Alpine 3.16 | curl | 8.1.0-r0 |
| Alpine 3.17 | curl | 8.1.0-r0 |
| Alpine 3.18 | curl | 8.1.0-r0 |
| Alpine 3.19 | curl | 8.1.0-r0 |
| Alpine 3.20 | curl | 8.1.0-r0 |
| Alpine 3.21 | curl | 8.1.0-r0 |
| Alpine 3.22 | curl | 8.1.0-r0 |
| Alpine 3.23 | curl | 8.1.0-r0 |
| Alpine 3.24 | curl | 8.1.0-r0 |
| Amazon Linux 2 | curl | 8.2.1-1.amzn2.0.2 |
| Amazon Linux 2 | libcurl | 8.2.1-1.amzn2.0.2 |
| Amazon Linux 2 | libcurl-devel | 8.2.1-1.amzn2.0.2 |
| Amazon Linux 2023 | curl | 8.0.1-1.amzn2023.0.1 |
| Amazon Linux 2023 | curl-minimal | 8.0.1-1.amzn2023.0.1 |
| Amazon Linux 2023 | libcurl | 8.0.1-1.amzn2023.0.1 |
| Amazon Linux 2023 | libcurl-devel | 8.0.1-1.amzn2023.0.1 |
| Amazon Linux 2023 | libcurl-minimal | 8.0.1-1.amzn2023.0.1 |
| Debian 10 | curl | 7.64.0-4+deb10u8 |
| Debian 12 | curl | 7.88.1-10 |
| Debian 13 | curl | 7.88.1-10 |
| Debian 14 | curl | 7.88.1-10 |
| Red Hat Enterprise Linux 8 | curl | 0:7.61.1-33.el8_9.5 |
| Red Hat Enterprise Linux 8 | curl-debuginfo | 0:7.61.1-33.el8_9.5 |
| Red Hat Enterprise Linux 8 | curl-debugsource | 0:7.61.1-33.el8_9.5 |
| Red Hat Enterprise Linux 8 | curl-minimal-debuginfo | 0:7.61.1-33.el8_9.5 |
| Red Hat Enterprise Linux 8 | libcurl | 0:7.61.1-33.el8_9.5 |
| Red Hat Enterprise Linux 8 | libcurl-debuginfo | 0:7.61.1-33.el8_9.5 |
| Red Hat Enterprise Linux 8 | libcurl-devel | 0:7.61.1-33.el8_9.5 |
| Red Hat Enterprise Linux 8 | libcurl-minimal | 0:7.61.1-33.el8_9.5 |
| Red Hat Enterprise Linux 8 | libcurl-minimal-debuginfo | 0:7.61.1-33.el8_9.5 |
| Red Hat Enterprise Linux 9 | curl | 0:7.76.1-23.el9_2.2 |
| Red Hat Enterprise Linux 9 | curl-debuginfo | 0:7.76.1-23.el9_2.2 |
| Red Hat Enterprise Linux 9 | curl-debugsource | 0:7.76.1-23.el9_2.2 |
| Red Hat Enterprise Linux 9 | curl-minimal | 0:7.76.1-23.el9_2.2 |
| Red Hat Enterprise Linux 9 | curl-minimal-debuginfo | 0:7.76.1-23.el9_2.2 |
| Red Hat Enterprise Linux 9 | libcurl | 0:7.76.1-23.el9_2.2 |
| Red Hat Enterprise Linux 9 | libcurl-debuginfo | 0:7.76.1-23.el9_2.2 |
| Red Hat Enterprise Linux 9 | libcurl-devel | 0:7.76.1-23.el9_2.2 |
| Red Hat Enterprise Linux 9 | libcurl-minimal | 0:7.76.1-23.el9_2.2 |
| Red Hat Enterprise Linux 9 | libcurl-minimal-debuginfo | 0:7.76.1-23.el9_2.2 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr | 0:1.7.0-8.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-apr | 0:1.7.0-8.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-debuginfo | 0:1.7.0-8.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-debuginfo | 0:1.7.0-8.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-devel | 0:1.7.0-8.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-devel | 0:1.7.0-8.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.2.1-1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.2.1-1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.2.1-1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.2.1-1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools-debuginfo | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.2.1-1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.2.1-1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-debuginfo | 0:8.2.1-1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.2.1-1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.2.1-1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap-debuginfo | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html-debuginfo | 1:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.3-29.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.3-29.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.3-29.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.3-29.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session-debuginfo | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl-debuginfo | 1:2.4.57-5.el8jbcs |
| Red Hat rhel eus 8.6 | curl | 0:7.61.1-22.el8_6.12 |
| Red Hat rhel eus 8.6 | curl-debuginfo | 0:7.61.1-22.el8_6.12 |
| Red Hat rhel eus 8.6 | curl-debugsource | 0:7.61.1-22.el8_6.12 |
| Red Hat rhel eus 8.6 | curl-minimal-debuginfo | 0:7.61.1-22.el8_6.12 |
| Red Hat rhel eus 8.6 | libcurl | 0:7.61.1-22.el8_6.12 |
| Red Hat rhel eus 8.6 | libcurl-debuginfo | 0:7.61.1-22.el8_6.12 |
| Red Hat rhel eus 8.6 | libcurl-devel | 0:7.61.1-22.el8_6.12 |
| Red Hat rhel eus 8.6 | libcurl-minimal | 0:7.61.1-22.el8_6.12 |
| Red Hat rhel eus 8.6 | libcurl-minimal-debuginfo | 0:7.61.1-22.el8_6.12 |
| Red Hat rhel eus 8.8 | curl | 0:7.61.1-30.el8_8.9 |
| Red Hat rhel eus 8.8 | curl-debuginfo | 0:7.61.1-30.el8_8.9 |
| Red Hat rhel eus 8.8 | curl-debugsource | 0:7.61.1-30.el8_8.9 |
| Red Hat rhel eus 8.8 | curl-minimal-debuginfo | 0:7.61.1-30.el8_8.9 |
| Red Hat rhel eus 8.8 | libcurl | 0:7.61.1-30.el8_8.9 |
| Red Hat rhel eus 8.8 | libcurl-debuginfo | 0:7.61.1-30.el8_8.9 |
| Red Hat rhel eus 8.8 | libcurl-devel | 0:7.61.1-30.el8_8.9 |
| Red Hat rhel eus 8.8 | libcurl-minimal | 0:7.61.1-30.el8_8.9 |
| Red Hat rhel eus 8.8 | libcurl-minimal-debuginfo | 0:7.61.1-30.el8_8.9 |
| Red Hat rhel eus 9.0 | curl | 0:7.76.1-14.el9_0.7 |
| Red Hat rhel eus 9.0 | curl-debuginfo | 0:7.76.1-14.el9_0.7 |
| Red Hat rhel eus 9.0 | curl-debugsource | 0:7.76.1-14.el9_0.7 |
| Red Hat rhel eus 9.0 | curl-minimal | 0:7.76.1-14.el9_0.7 |
| Red Hat rhel eus 9.0 | curl-minimal-debuginfo | 0:7.76.1-14.el9_0.7 |
| Red Hat rhel eus 9.0 | libcurl | 0:7.76.1-14.el9_0.7 |
| Red Hat rhel eus 9.0 | libcurl-debuginfo | 0:7.76.1-14.el9_0.7 |
| Red Hat rhel eus 9.0 | libcurl-devel | 0:7.76.1-14.el9_0.7 |
| Red Hat rhel eus 9.0 | libcurl-minimal | 0:7.76.1-14.el9_0.7 |
| Red Hat rhel eus 9.0 | libcurl-minimal-debuginfo | 0:7.76.1-14.el9_0.7 |
| Rocky Linux 8 | curl | 0:7.61.1-33.el8_9.5 |
| SUSE Enterprise Storage 6 | curl | 7.60.0-150000.51.1 |
| SUSE Enterprise Storage 7 | curl | 7.66.0-150200.4.57.1 |
| SUSE Enterprise Storage 7.1 | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | curl | 7.60.0-150000.51.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise Micro 5.1 | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise Micro 5.2 | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise Micro 5.3 | curl | 8.0.1-150400.5.23.1 |
| SUSE Linux Enterprise Micro 5.4 | curl | 8.0.1-150400.5.23.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | curl | 8.0.1-150400.5.23.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | curl | 7.37.0-37.98.1 |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | curl | 7.60.0-4.56.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | curl | 7.60.0-4.56.1 |
| SUSE Linux Enterprise Server 12 SP5 | curl | 8.0.1-11.65.2 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | curl | 7.60.0-150000.51.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | curl | 7.60.0-4.56.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | curl | 8.0.1-11.65.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | curl | 7.60.0-150000.51.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | curl | 7.66.0-150200.4.57.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | curl | 8.0.1-11.65.2 |
| SUSE Manager Proxy 4.2 | curl | 7.66.0-150200.4.57.1 |
| SUSE Manager Server 4.2 | curl | 7.66.0-150200.4.57.1 |
| SUSE OpenStack Cloud 9 | curl | 7.60.0-4.56.1 |
| SUSE OpenStack Cloud Crowbar 9 | curl | 7.60.0-4.56.1 |
| Ubuntu 20.04 LTS | curl | 7.68.0-1ubuntu2.19 |
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.11 |
| Ubuntu Pro 14.04 LTS | curl | 7.35.0-1ubuntu2.20+esm16 |
| Ubuntu Pro 16.04 LTS | curl | 7.47.0-1ubuntu2.19+esm9 |
| Ubuntu Pro 18.04 LTS | curl | 7.58.0-2ubuntu3.24+esm1 |
| openSUSE Leap 15.4 | curl | 8.0.1-150400.5.23.1 |
| openSUSE Leap 15.5 | curl | 8.0.1-150400.5.23.1 |
| openSUSE Leap Micro 5.3 | curl | 8.0.1-150400.5.23.1 |
| openSUSE Tumbleweed | curl | 8.1.0-1.1 |