CVE-2023-27538 | Vulnetix

CVE-2023-27538 PUBLISHED CVSS 5.5 MEDIUM

Reported by hackerone · Published March 30, 2023

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
libcurl	conan.io	8.0.0
libcurl-minimal	Amazon Linux	8.0.1-1.amzn2023
curl	Amazon Linux	8.0.1-1.amzn2023, 8.0.1-1.amzn2.0.1
curl	Alpine	8.0.1-r0, 8.0.0-r0, 7.88.1-r1
libcurl-devel	Amazon Linux	8.0.1-1.amzn2023, 8.0.1-1.amzn2.0.1
libcurl	Amazon Linux	8.0.1-1.amzn2023, 8.0.1-1.amzn2.0.1
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Siemens	3.1.5
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Siemens	3.1.5
universal_forwarder	splunk	9.0.6, 8.2.12
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Siemens	3.1.5

Risk scores

CVSS 3.1

5.5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Vendor	Product	Versions
n/a	https://github.com/curl/curl	Fixed in 8.0.0
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	3.1.0
amazon:2023	libcurl-minimal	0
amazon:2023	curl	0
alpine	curl	0, 0, 0
amazon:2	libcurl-devel	0
amazon:2	libcurl	0
amazon:2	curl	0
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	3.1.0
amazon:2023	libcurl-devel	0
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	3.1.0
amazon:2023	libcurl	0
ConanCenter	libcurl	7.16.1
n/a	https://github.com/curl/curl	8.0.0
amazon:2023	curl-minimal	0

Timeline

Mar 22, 2023 PoC Published (6 in total, the first dated here)
Mar 30, 2023 CVE Published
Mar 31, 2023 EPSS Score (30 in total, the first dated here)
Mar 17, 2026 Security Advisory (16 in total, the first dated here)
Jul 23, 2026 Distribution Patch (13 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-27538
vulnetix vdb fixes CVE-2023-27538

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-27538/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →