curl / Docs / curl CVEs / HSTS long filename clears contents
Awarded 540 USD

CVE-2023-46219

HSTS long filename clears contents

Project curl Security Advisory, December 6 2023 - Permalink

VULNERABILITY

When saving HSTS data to an excessively long filename, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

INFO

The reason for this bug is that save function appended a suffix to the file name, created a temporary file and then in the last step renamed that to the final name. When the filename length was close to the limit of what is allowed on the file system, adding the extension would make it too long and then trigger this bug.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2023-46219 to this issue.

CWE-311: Missing Encryption of Sensitive Data

Severity: Low

AFFECTED VERSIONS

libcurl is used by many applications, but not always advertised as such!

This flaw is also accessible using the curl command line tool.

SOLUTION

Starting in curl 8.5.0, the temporary filename made done using a pure random sequence of letters instead of being based on the original.

RECOMMENDATIONS

A - Upgrade curl to version 8.5.0

B - Apply the patch to your local version

C - Do not use HSTS

TIMELINE

This issue was reported to the curl project on November 2, 2023. We contacted distros@openwall on November 28, 2023.

curl 8.5.0 was released on December 6 2023, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!