PT-2023-5883 · Curl+12 · Curl+12
Utsweetyfish
·
Published
2022-08-03
·
Updated
2026-06-05
·
CVE-2023-38545
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
curl versions 7.82.0 through 8.4.0
libcurl versions 7.82.0 through 8.4.0
MySQL versions 5.7.43 and earlier, 8.0.34 and earlier, 8.1.0 and earlier
Description
curl and libcurl are vulnerable to a heap buffer overflow in the SOCKS5 proxy handshake. This occurs when curl is configured to use a SOCKS5 proxy to resolve hostnames. If the hostname is longer than 255 bytes, curl may switch to local name resolving and incorrectly copy the oversized hostname into a buffer, leading to a potential crash or remote code execution. The vulnerability also affects MySQL versions 5.7.43 and earlier, 8.0.34 and earlier, and 8.1.0 and earlier.
Recommendations
Upgrade curl to version 8.4.0 or later.
Upgrade libcurl to version 8.4.0 or later.
Upgrade MySQL to a version later than 8.1.0.
If unable to upgrade, consider disabling the use of SOCKS5 proxies with curl.
Exploit
Fix
RCE
DoS
Memory Corruption
Heap Based Buffer Overflow
Improper Certificate Validation
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Fortios
Ibm Aix
Linuxmint
Apple Macos
Mysql Server
Red Hat
Red Os
Suse
Ubuntu
Windows
Curl