{"id":"USN-6237-3","summary":"curl vulnerabilities","details":"USN-6237-1 fixed several vulnerabilities in curl. This update provides the\ncorresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and\nUbuntu 18.04 LTS.\n\nOriginal advisory details:\n\n Hiroki Kurosawa discovered that curl incorrectly handled validating certain\n certificate wildcards. A remote attacker could possibly use this issue to\n spoof certain website certificates using IDN hosts. (CVE-2023-28321)\n \n Hiroki Kurosawa discovered that curl incorrectly handled callbacks when\n certain options are set by applications. This could cause applications\n using curl to misbehave, resulting in information disclosure, or a denial\n of service. (CVE-2023-28322)\n \n It was discovered that curl incorrectly handled saving cookies to files. A\n local attacker could possibly use this issue to create or overwrite files.\n This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)\n","modified":"2026-02-17T21:50:47.034412Z","published":"2023-09-11T18:00:42Z","related":["UBUNTU-CVE-2023-28321","UBUNTU-CVE-2023-28322"],"upstream":["CVE-2023-28321","CVE-2023-28322","UBUNTU-CVE-2023-28321","UBUNTU-CVE-2023-28322"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6237-3"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-28321"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-28322"}],"affected":[{"package":{"name":"curl","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.20+esm16?arch=source&distro=trusty/esm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm16"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13","7.35.0-1ubuntu2.20+esm14","7.35.0-1ubuntu2.20+esm15"],"ecosystem_specific":{"binaries":[{"binary_version":"7.35.0-1ubuntu2.20+esm16","binary_name":"curl"},{"binary_version":"7.35.0-1ubuntu2.20+esm16","binary_name":"libcurl3"},{"binary_version":"7.35.0-1ubuntu2.20+esm16","binary_name":"libcurl3-gnutls"},{"binary_version":"7.35.0-1ubuntu2.20+esm16","binary_name":"libcurl3-nss"},{"binary_version":"7.35.0-1ubuntu2.20+esm16","binary_name":"libcurl4-gnutls-dev"},{"binary_version":"7.35.0-1ubuntu2.20+esm16","binary_name":"libcurl4-nss-dev"},{"binary_version":"7.35.0-1ubuntu2.20+esm16","binary_name":"libcurl4-openssl-dev"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:14.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}],"id":"CVE-2023-28321"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}],"id":"CVE-2023-28322"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6237-3.json"}},{"package":{"name":"curl","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/curl@7.47.0-1ubuntu2.19+esm9?arch=source&distro=esm-infra/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm9"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2","7.47.0-1ubuntu2.19+esm3","7.47.0-1ubuntu2.19+esm4","7.47.0-1ubuntu2.19+esm5","7.47.0-1ubuntu2.19+esm6","7.47.0-1ubuntu2.19+esm7","7.47.0-1ubuntu2.19+esm8"],"ecosystem_specific":{"binaries":[{"binary_version":"7.47.0-1ubuntu2.19+esm9","binary_name":"curl"},{"binary_version":"7.47.0-1ubuntu2.19+esm9","binary_name":"libcurl3"},{"binary_version":"7.47.0-1ubuntu2.19+esm9","binary_name":"libcurl3-gnutls"},{"binary_version":"7.47.0-1ubuntu2.19+esm9","binary_name":"libcurl3-nss"},{"binary_version":"7.47.0-1ubuntu2.19+esm9","binary_name":"libcurl4-gnutls-dev"},{"binary_version":"7.47.0-1ubuntu2.19+esm9","binary_name":"libcurl4-nss-dev"},{"binary_version":"7.47.0-1ubuntu2.19+esm9","binary_name":"libcurl4-openssl-dev"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:16.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}],"id":"CVE-2023-28321"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}],"id":"CVE-2023-28322"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6237-3.json"}},{"package":{"name":"curl","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/curl@7.58.0-2ubuntu3.24+esm1?arch=source&distro=esm-infra/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+esm1"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16","7.58.0-2ubuntu3.17","7.58.0-2ubuntu3.18","7.58.0-2ubuntu3.19","7.58.0-2ubuntu3.20","7.58.0-2ubuntu3.21","7.58.0-2ubuntu3.22","7.58.0-2ubuntu3.23","7.58.0-2ubuntu3.24"],"ecosystem_specific":{"binaries":[{"binary_version":"7.58.0-2ubuntu3.24+esm1","binary_name":"curl"},{"binary_version":"7.58.0-2ubuntu3.24+esm1","binary_name":"libcurl3-gnutls"},{"binary_version":"7.58.0-2ubuntu3.24+esm1","binary_name":"libcurl3-nss"},{"binary_version":"7.58.0-2ubuntu3.24+esm1","binary_name":"libcurl4"},{"binary_version":"7.58.0-2ubuntu3.24+esm1","binary_name":"libcurl4-gnutls-dev"},{"binary_version":"7.58.0-2ubuntu3.24+esm1","binary_name":"libcurl4-nss-dev"},{"binary_version":"7.58.0-2ubuntu3.24+esm1","binary_name":"libcurl4-openssl-dev"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}],"id":"CVE-2023-28321"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}],"id":"CVE-2023-28322"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6237-3.json"}}],"schema_version":"1.7.3"}