rpm package
suse/curl&distro=SUSE Manager Proxy 4.2
pkg:rpm/suse/curl&distro=SUSE%20Manager%20Proxy%204.2
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-38546 | Low | 3.7 | < 7.66.0-150200.4.60.1 | 7.66.0-150200.4.60.1 | Oct 18, 2023 | This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl | |
| CVE-2023-28322 | — | < 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 | May 26, 2023 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was | ||
| CVE-2023-28321 | — | < 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 | May 26, 2023 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provi | ||
| CVE-2023-28320 | — | < 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 | May 26, 2023 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` an |
- affected < 7.66.0-150200.4.60.1fixed 7.66.0-150200.4.60.1
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl
- CVE-2023-28322May 26, 2023affected < 7.66.0-150200.4.57.1fixed 7.66.0-150200.4.57.1
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was
- CVE-2023-28321May 26, 2023affected < 7.66.0-150200.4.57.1fixed 7.66.0-150200.4.57.1
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provi
- CVE-2023-28320May 26, 2023affected < 7.66.0-150200.4.57.1fixed 7.66.0-150200.4.57.1
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` an