Bug 2179062 (CVE-2023-27533)

Summary: CVE-2023-27533 curl: TELNET option IAC injection
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: andrew.slice, bodavis, csutherl, dbhole, jclere, kdudka, lvaleeva, mturk, omajid, peholase, pjindal, plodge, rwagner, szappis
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: curl 8.0.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2180427, 2180428, 2183167    
Bug Blocks: 2178228    

Description Marian Rehak 2023-03-16 14:46:05 UTC
curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and "telnet options" for the server
negotiation. Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass on user name and telnet options to the server as provided. This could allow users to pass in carefully crafted content that pass on content or do option negotiation without the application intending to do so. In particular if an application for example allows users to provide the data or parts of the data.

Comment 1 Marian Rehak 2023-03-16 14:55:03 UTC
Not affected versions: curl < 7.7 and curl >= 8.0.0

Comment 3 Sandipan Roy 2023-03-21 13:03:53 UTC
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 2180427]

Created mingw-curl tracking bugs for this issue:

Affects: fedora-all [bug 2180428]

Comment 7 errata-xmlrpc 2023-07-18 17:29:16 UTC
This issue has been addressed in the following products:

  JBCS httpd 2.4.51.sp2

Via RHSA-2023:3355 https://access.redhat.com/errata/RHSA-2023:3355

Comment 8 errata-xmlrpc 2023-07-18 17:29:40 UTC
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2023:3354 https://access.redhat.com/errata/RHSA-2023:3354

Comment 9 errata-xmlrpc 2023-11-07 08:22:31 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6679 https://access.redhat.com/errata/RHSA-2023:6679