curl -- multiple vulnerabilitiesentered 2023-03-20
no CVE referenced
CVE details
CVE-2023-27533
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.
Affected ports (2)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| ftp/linux-c7-curl | linux-c7-curl | 7.29.0_13 | unaddressed | emulation@FreeBSD.org |
| ftp/linux-rl9-curl | linux-rl9-curl | 7.76.1_13 | unaddressed | emulation@FreeBSD.org |
VuXML
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>linux-c7-curl</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>linux-rl9-curl</name>
<range><lt>FIXME</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A vulnerability in input validation exists in curl <8.0 during
communication using the TELNET protocol may allow an attacker to pass
on maliciously crafted user name and "telnet options" during server
negotiation. The lack of proper input scrubbing allows an attacker to
send content or perform option negotiation without the application's
intent. This vulnerability could be exploited if an application allows
user input, thereby enabling attackers to execute arbitrary code on
the system.</p>
</body>
</description>
<references>
<cvename>CVE-2023-27533</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-27533</url>
</references>
<dates>
<discovery>2023-03-30</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>