Bug 2241938 (CVE-2023-38546)

Summary: CVE-2023-38546 curl: cookie injection with none file
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: andrew.slice, bbuckingham, bcourt, bodavis, csutherl, dbhole, ehelms, gcovolo, jclere, jfindysz, jsherril, kyoshida, lvaleeva, lzap, marco.crociani, mhulan, mturk, nmoumoul, omajid, orabin, pcreech, peholase, pjindal, plodge, rchan, rwagner, security-response-team, snavale, sujagtap, szappis
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: curl 8.4.0 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Curl package. This flaw allows an attacker to insert cookies into a running program using libcurl if the specific series of conditions are met.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2261929, 2253022    
Bug Blocks: 2241927    

Description Marian Rehak 2023-10-03 14:09:52 UTC
If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as
`none`. Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Comment 5 errata-xmlrpc 2023-10-13 21:46:44 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:5700 https://access.redhat.com/errata/RHSA-2023:5700

Comment 6 errata-xmlrpc 2023-10-17 08:58:30 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:5763 https://access.redhat.com/errata/RHSA-2023:5763

Comment 8 errata-xmlrpc 2023-11-02 16:02:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:6292 https://access.redhat.com/errata/RHSA-2023:6292

Comment 9 errata-xmlrpc 2023-11-07 10:27:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6745 https://access.redhat.com/errata/RHSA-2023:6745

Comment 12 marco.crociani 2023-11-23 17:58:27 UTC
from https://access.redhat.com/security/cve/cve-2023-38546

this is fixed in RHEL 8.6 extended support (curl-7.61.1-22.el8_6.9.src.rpm  https://access.redhat.com/errata/RHSA-2023:6292 )
While it says affected for RHEL8.

Is this fixed in RHEL 8.9 curl-7.61.1-33.src.rom ?

If not, when will it be fixed?

Thank you,

Comment 13 marco.crociani 2023-11-23 17:58:45 UTC
from https://access.redhat.com/security/cve/cve-2023-38546

this is fixed in RHEL 8.6 extended support (curl-7.61.1-22.el8_6.9.src.rpm  https://access.redhat.com/errata/RHSA-2023:6292 )
While it says affected for RHEL8.

Is this fixed in RHEL 8.9 curl-7.61.1-33.src.rom ?

If not, when will it be fixed?

Thank you,

Comment 14 errata-xmlrpc 2023-11-28 15:36:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2023:7540 https://access.redhat.com/errata/RHSA-2023:7540

Comment 16 errata-xmlrpc 2023-12-07 13:49:33 UTC
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2023:7625 https://access.redhat.com/errata/RHSA-2023:7625

Comment 17 errata-xmlrpc 2023-12-07 13:55:45 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2023:7626 https://access.redhat.com/errata/RHSA-2023:7626

Comment 21 errata-xmlrpc 2024-04-02 15:55:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1601 https://access.redhat.com/errata/RHSA-2024:1601