CVE-2023-28319

HIGH

curl < 8.1.0 - Use-After-Free in SSH Server Public Key Verification

Title source: llm
STIX 2.1

Description

A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.

References (9)

Core 9
Core References
Exploit, Patch, Third Party Advisory
https://hackerone.com/reports/1913733
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2023/Jul/52
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2023/Jul/48
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2023/Jul/47
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202310-12

Scores

CVSS v3 7.5
EPSS 0.0032
EPSS Percentile 55.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-416
Status published
Products (8)
apple/macos 11.0 - 11.7.9
haxx/curl < 8.1.0
netapp/clustered_data_ontap
netapp/h300s_firmware
netapp/h410s_firmware
netapp/h500s_firmware
netapp/h700s_firmware
netapp/ontap_antivirus_connector
Published May 26, 2023
Tracked Since Feb 18, 2026