CVE-2023-38039

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-38039

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

W

hen curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

References
Link Resource
http://seclists.org/fulldisclosure/2023/Oct/17 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jan/34 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jan/37 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jan/38 Mailing List Third Party Advisory
https://hackerone.com/reports/2072338 Exploit Issue Tracking Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/ Mailing List
https://security.gentoo.org/glsa/202310-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20231013-0005/ Third Party Advisory
https://support.apple.com/kb/HT214036 Third Party Advisory
https://support.apple.com/kb/HT214057 Third Party Advisory
https://support.apple.com/kb/HT214058 Third Party Advisory
https://support.apple.com/kb/HT214063 Third Party Advisory
https://www.insyde.com/security-pledge/SA-2023064 Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/17 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jan/34 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jan/37 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jan/38 Mailing List Third Party Advisory
https://hackerone.com/reports/2072338 Exploit Issue Tracking Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/ Mailing List
https://security.gentoo.org/glsa/202310-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20231013-0005/ Third Party Advisory
https://support.apple.com/kb/HT214036 Third Party Advisory
https://support.apple.com/kb/HT214057 Third Party Advisory
https://support.apple.com/kb/HT214058 Third Party Advisory
https://support.apple.com/kb/HT214063 Third Party Advisory
https://www.insyde.com/security-pledge/SA-2023064 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
History

21 Nov 2024, 08:12

Type Values Removed Values Added
References () http://seclists.org/fulldisclosure/2023/Oct/17 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2023/Oct/17 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jan/34 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2024/Jan/34 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jan/37 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2024/Jan/37 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jan/38 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2024/Jan/38 - Mailing List, Third Party Advisory
References () https://hackerone.com/reports/2072338 - Exploit, Issue Tracking, Patch, Third Party Advisory () https://hackerone.com/reports/2072338 - Exploit, Issue Tracking, Patch, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/ - Mailing List () https://lists.fedoraproject.org/archives/list/[email protected]/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/ - Mailing List () https://lists.fedoraproject.org/archives/list/[email protected]/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/ - Mailing List () https://lists.fedoraproject.org/archives/list/[email protected]/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/ - Mailing List
References () https://security.gentoo.org/glsa/202310-12 - Third Party Advisory () https://security.gentoo.org/glsa/202310-12 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20231013-0005/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20231013-0005/ - Third Party Advisory
References () https://support.apple.com/kb/HT214036 - Third Party Advisory () https://support.apple.com/kb/HT214036 - Third Party Advisory
References () https://support.apple.com/kb/HT214057 - Third Party Advisory () https://support.apple.com/kb/HT214057 - Third Party Advisory
References () https://support.apple.com/kb/HT214058 - Third Party Advisory () https://support.apple.com/kb/HT214058 - Third Party Advisory
References () https://support.apple.com/kb/HT214063 - Third Party Advisory () https://support.apple.com/kb/HT214063 - Third Party Advisory
References () https://www.insyde.com/security-pledge/SA-2023064 - Third Party Advisory () https://www.insyde.com/security-pledge/SA-2023064 - Third Party Advisory
Information

Published : 2023-09-15 04:15

Updated : 2025-12-02 20:15

NVD link : CVE-2023-38039

Mitre link : CVE-2023-38039

CVE.ORG link : CVE-2023-38039

JSON object : View

Products Affected

fedoraproject

microsoft

haxx

CWE
CWE-770

Allocation of Resources Without Limits or Throttling