Bug 2241938 (CVE-2023-38546)
| Summary: | CVE-2023-38546 curl: cookie injection with none file | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | andrew.slice, bbuckingham, bcourt, bodavis, csutherl, dbhole, ehelms, gcovolo, ggainey, jclere, jfindysz, jsherril, juwatts, kyoshida, lzap, marco.crociani, mhulan, msunil, nmoumoul, omajid, orabin, pcreech, peholase, pjindal, plodge, rchan, security-response-team, smallamp, snavale, sujagtap, szappis |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | curl 8.4.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the Curl package. This flaw allows an attacker to insert cookies into a running program using libcurl if the specific series of conditions are met.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2253022, 2261929 | ||
| Bug Blocks: | 2241927 | ||
|
Description
Marian Rehak
2023-10-03 14:09:52 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:5700 https://access.redhat.com/errata/RHSA-2023:5700 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:5763 https://access.redhat.com/errata/RHSA-2023:5763 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:6292 https://access.redhat.com/errata/RHSA-2023:6292 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:6745 https://access.redhat.com/errata/RHSA-2023:6745 from https://access.redhat.com/security/cve/cve-2023-38546 this is fixed in RHEL 8.6 extended support (curl-7.61.1-22.el8_6.9.src.rpm https://access.redhat.com/errata/RHSA-2023:6292 ) While it says affected for RHEL8. Is this fixed in RHEL 8.9 curl-7.61.1-33.src.rom ? If not, when will it be fixed? Thank you, from https://access.redhat.com/security/cve/cve-2023-38546 this is fixed in RHEL 8.6 extended support (curl-7.61.1-22.el8_6.9.src.rpm https://access.redhat.com/errata/RHSA-2023:6292 ) While it says affected for RHEL8. Is this fixed in RHEL 8.9 curl-7.61.1-33.src.rom ? If not, when will it be fixed? Thank you, This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2023:7540 https://access.redhat.com/errata/RHSA-2023:7540 This issue has been addressed in the following products: JBoss Core Services on RHEL 7 JBoss Core Services for RHEL 8 Via RHSA-2023:7625 https://access.redhat.com/errata/RHSA-2023:7625 This issue has been addressed in the following products: Red Hat JBoss Core Services Via RHSA-2023:7626 https://access.redhat.com/errata/RHSA-2023:7626 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:1601 https://access.redhat.com/errata/RHSA-2024:1601 This issue has been addressed in the following products: Satellite Client 6 for RHEL 6 Satellite Client 6 for RHEL 7 Satellite Client 6 for RHEL 8 Satellite Client 6 for RHEL 9 Via RHSA-2024:2101 https://access.redhat.com/errata/RHSA-2024:2101 |