CVE-2023-28319

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	https://github.com/curl/curl	Fixed in 8.1.0

References

http://seclists.org/fulldisclosure/2023/Jul/47Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/48Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/52Mailing List, Third Party Advisory
https://hackerone.com/reports/1913733Exploit, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202310-12Third Party Advisory
https://security.netapp.com/advisory/ntap-20230609-0009/Third Party Advisory
https://support.apple.com/kb/HT213843Third Party Advisory
https://support.apple.com/kb/HT213844Third Party Advisory
https://support.apple.com/kb/HT213845Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/47Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/48Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/52Mailing List, Third Party Advisory
https://hackerone.com/reports/1913733Exploit, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202310-12Third Party Advisory
https://security.netapp.com/advisory/ntap-20230609-0009/Third Party Advisory
https://support.apple.com/kb/HT213843Third Party Advisory
https://support.apple.com/kb/HT213844Third Party Advisory
https://support.apple.com/kb/HT213845Third Party Advisory

Timeline

Published: May 26, 2023
Last modified: Oct 23, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-28327.2SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0.CVE-2023-283205.9A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, se CVE-2023-283215.9An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as CVE-2023-283223.7An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback CVE-2023-283239.8A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. Thi CVE-2023-283249.8A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote c CVE-2023-283256.5An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the CVE-2023-283269.8Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate th CVE-2023-283275.5A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allo CVE-2023-283285.5A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from u CVE-2023-283298.8Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and CVE-2023-28338.8The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restrict