CVE-2023-23916

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-23916
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://hackerone.com/reports/1826048 Exploit Issue Tracking
https://lists.debian.org/debian-lts-announce/2023/02/msg00035.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/ Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202310-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20230309-0006/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5365 Third Party Advisory
https://hackerone.com/reports/1826048 Exploit Issue Tracking
https://lists.debian.org/debian-lts-announce/2023/02/msg00035.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/ Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202310-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20230309-0006/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5365 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 8 (hide)

cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

Configuration 9 (hide)

OR cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
History

21 Nov 2024, 07:47

Type Values Removed Values Added
References () https://hackerone.com/reports/1826048 - Exploit, Issue Tracking () https://hackerone.com/reports/1826048 - Exploit, Issue Tracking
References () https://lists.debian.org/debian-lts-announce/2023/02/msg00035.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/02/msg00035.html - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/ - Mailing List, Third Party Advisory () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/ - Mailing List, Third Party Advisory
References () https://security.gentoo.org/glsa/202310-12 - Third Party Advisory () https://security.gentoo.org/glsa/202310-12 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20230309-0006/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20230309-0006/ - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5365 - Third Party Advisory () https://www.debian.org/security/2023/dsa-5365 - Third Party Advisory

27 Mar 2024, 14:54

Type Values Removed Values Added
CPE cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/ - Mailing List, Third Party Advisory
First Time Splunk
Splunk universal Forwarder

07 Nov 2023, 04:08

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/', 'name': 'FEDORA-2023-94df30cbec', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/ -

20 Oct 2023, 18:56

Type Values Removed Values Added
References (GENTOO) https://security.gentoo.org/glsa/202310-12 - (GENTOO) https://security.gentoo.org/glsa/202310-12 - Third Party Advisory

11 Oct 2023, 11:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202310-12 -

18 Apr 2023, 16:49

Type Values Removed Values Added
First Time Netapp h700s
Netapp h500s
Netapp h300s
Netapp
Netapp h700s Firmware
Netapp h500s Firmware
Netapp clustered Data Ontap
Netapp h300s Firmware
Netapp h410s
Netapp h410s Firmware
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 6.5
References (CONFIRM) https://security.netapp.com/advisory/ntap-20230309-0006/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20230309-0006/ - Third Party Advisory
CPE cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
Information

Published : 2023-02-23 20:15

Updated : 2025-03-12 19:15

NVD link : CVE-2023-23916

Mitre link : CVE-2023-23916

CVE.ORG link : CVE-2023-23916

JSON object : View

Products Affected

haxx

  • curl

netapp

  • h700s_firmware
  • h410s_firmware
  • h700s
  • h500s
  • h410s
  • h300s
  • h300s_firmware
  • h500s_firmware
  • clustered_data_ontap

debian

  • debian_linux

splunk

  • universal_forwarder

fedoraproject

  • fedora
CWE
CWE-770

Allocation of Resources Without Limits or Throttling