Vulnerabilities > CVE-2023-28319 - Use After Free vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

NVD

Published: 2023-05-26

Updated: 2023-10-20

Summary

A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.

Vulnerable Configurations

Part	Description	Count
Application	Haxx Haxx Curl - Haxx Curl 4.9 Haxx Curl 6.0 Haxx Curl 6.1 Haxx Curl 6.2 Haxx Curl 6.3 Haxx Curl 6.3.1 Haxx Curl 6.4 Haxx Curl 6.5 Haxx Curl 6.5.1 Haxx Curl 6.5.2 Haxx Curl 7.1 Haxx Curl 7.1.1 Haxx Curl 7.2 Haxx Curl 7.2.1 Haxx Curl 7.3 Haxx Curl 7.4 Haxx Curl 7.4.1 Haxx Curl 7.4.2 Haxx Curl 7.5 Haxx Curl 7.5.1 Haxx Curl 7.5.2 Haxx Curl 7.6 Haxx Curl 7.6.1 Haxx Curl 7.7 Haxx Curl 7.7.1 Haxx Curl 7.7.2 Haxx Curl 7.7.3 Haxx Curl 7.8 Haxx Curl 7.8.1 Haxx Curl 7.9 Haxx Curl 7.9.1 Haxx Curl 7.9.2 Haxx Curl 7.9.3 Haxx Curl 7.9.4 Haxx Curl 7.9.5 Haxx Curl 7.9.6 Haxx Curl 7.9.7 Haxx Curl 7.9.8 Haxx Curl 7.10 Haxx Curl 7.10.1 Haxx Curl 7.10.2 Haxx Curl 7.10.3 Haxx Curl 7.10.4 Haxx Curl 7.10.5 Haxx Curl 7.10.6 Haxx Curl 7.10.7 Haxx Curl 7.10.8 Haxx Curl 7.11.0 Haxx Curl 7.11.1 Haxx Curl 7.11.2 Haxx Curl 7.12.0 Haxx Curl 7.12.1 Haxx Curl 7.12.2 Haxx Curl 7.12.3 Haxx Curl 7.13.0 Haxx Curl 7.13.1 Haxx Curl 7.13.2 Haxx Curl 7.14.0 Haxx Curl 7.14.1 Haxx Curl 7.15.0 Haxx Curl 7.15.1 Haxx Curl 7.15.2 Haxx Curl 7.15.3 Haxx Curl 7.15.4 Haxx Curl 7.15.5 Haxx Curl 7.16.0 Haxx Curl 7.16.1 Haxx Curl 7.16.2 Haxx Curl 7.16.3 Haxx Curl 7.16.4 Haxx Curl 7.17.0 Haxx Curl 7.17.1 Haxx Curl 7.18.0 Haxx Curl 7.18.1 Haxx Curl 7.18.2 Haxx Curl 7.19.0 Haxx Curl 7.19.1 Haxx Curl 7.19.2 Haxx Curl 7.19.3 Haxx Curl 7.19.4 Haxx Curl 7.19.5 Haxx Curl 7.19.6 Haxx Curl 7.19.7 Haxx Curl 7.19.7-53 Haxx Curl 7.20.0 Haxx Curl 7.20.1 Haxx Curl 7.21.0 Haxx Curl 7.21.1 Haxx Curl 7.21.2 Haxx Curl 7.21.3 Haxx Curl 7.21.4 Haxx Curl 7.21.5 Haxx Curl 7.21.6 Haxx Curl 7.21.7 Haxx Curl 7.22.0 Haxx Curl 7.23.0 Haxx Curl 7.23.1 Haxx Curl 7.24.0 Haxx Curl 7.25.0 Haxx Curl 7.26.0 Haxx Curl 7.27.0 Haxx Curl 7.28.0 Haxx Curl 7.28.1 Haxx Curl 7.29.0 Haxx Curl 7.30.0 Haxx Curl 7.31.0 Haxx Curl 7.32.0 Haxx Curl 7.33.0 Haxx Curl 7.34.0 Haxx Curl 7.35.0 Haxx Curl 7.36.0 Haxx Curl 7.37.0 Haxx Curl 7.37.1 Haxx Curl 7.38.0 Haxx Curl 7.39.0 Haxx Curl 7.40.0 Haxx Curl 7.41.0 Haxx Curl 7.42.0 Haxx Curl 7.42.1 Haxx Curl 7.43.0 Haxx Curl 7.44.0 Haxx Curl 7.45.0 Haxx Curl 7.46.0 Haxx Curl 7.47.0 Haxx Curl 7.47.1 Haxx Curl 7.48.0 Haxx Curl 7.49.0 Haxx Curl 7.49.1 Haxx Curl 7.50.0 Haxx Curl 7.50.1 Haxx Curl 7.50.2 Haxx Curl 7.50.3 Haxx Curl 7.51.0 Haxx Curl 7.52.0 Haxx Curl 7.52.1 Haxx Curl 7.53.0 Haxx Curl 7.53.1 Haxx Curl 7.54.0 Haxx Curl 7.54.1 Haxx Curl 7.55.0 Haxx Curl 7.55.1 Haxx Curl 7.56.0 Haxx Curl 7.56.1 Haxx Curl 7.57.0 Haxx Curl 7.58.0 Haxx Curl 7.59.0 Haxx Curl 7.60.0 Haxx Curl 7.61.0 Haxx Curl 7.61.1 Haxx Curl 7.62.0 Haxx Curl 7.63.0 Haxx Curl 7.64.0 Haxx Curl 7.64.1 Haxx Curl 7.65.0 Haxx Curl 7.65.1 Haxx Curl 7.65.2 Haxx Curl 7.65.3 Haxx Curl 7.66.0 Haxx Curl 7.67.0 Haxx Curl 7.68.0 Haxx Curl 7.69.0 Haxx Curl 7.69.1 Haxx Curl 7.70.0 Haxx Curl 7.71.0 Haxx Curl 7.71.1 Haxx Curl 7.72.0 Haxx Curl 7.73.0 Haxx Curl 7.74.0 Haxx Curl 7.75.0 Haxx Curl 7.76.0 Haxx Curl 7.76.1 Haxx Curl 7.77.0 Haxx Curl 7.78.0 Haxx Curl 7.79.0 Haxx Curl 7.79.1 Haxx Curl 7.80.0 Haxx Curl 7.81.0 Haxx Curl 7.82.0 Haxx Curl 7.83.0 Haxx Curl 7.83.1 Haxx Curl 7.84.0 Haxx Curl 7.85.0 Haxx Curl 7.86.0 Haxx Curl 7.87.0 Haxx Curl 7.88.0 Haxx Curl 7.88.1 Haxx Curl 8.0.0 Haxx Curl 8.0.1	192
Application	Netapp Netapp Clustered Data Ontap - Netapp Ontap Antivirus Connector -	2
OS	Apple Apple Macos 13.0 Apple Macos 13.0.1 Apple Macos 13.1 Apple Macos 13.2 Apple Macos 13.2.1 Apple Macos 13.3 Apple Macos 13.3.1 Apple Macos 13.3.3 Apple Macos 13.4 Apple Macos 12.0 Apple Macos 12.0.0 Apple Macos 12.0.1 Apple Macos 12.1 Apple Macos 12.2 Apple Macos 12.2.1 Apple Macos 12.3 Apple Macos 12.4 Apple Macos 12.5 Apple Macos 12.5.1 Apple Macos 12.6 Apple Macos 12.6.1 Apple Macos 12.6.2 Apple Macos 12.6.3 Apple Macos 12.6.4 Apple Macos 12.6.5 Apple Macos 12.6.6 Apple Macos 12.6.7 Apple Macos 11.0 Apple Macos 11.0.1 Apple Macos 11.1 Apple Macos 11.1.0 Apple Macos 11.2 Apple Macos 11.2.1 Apple Macos 11.3 Apple Macos 11.3.1 Apple Macos 11.4 Apple Macos 11.5 Apple Macos 11.6 Apple Macos 11.6.1 Apple Macos 11.6.2 Apple Macos 11.6.3 Apple Macos 11.6.5 Apple Macos 11.6.6 Apple Macos 11.6.7 Apple Macos 11.6.8 Apple Macos 11.7 Apple Macos 11.7.1 Apple Macos 11.7.2 Apple Macos 11.7.3 Apple Macos 11.7.5 Apple Macos 11.7.6 Apple Macos 11.7.7	52
OS	Netapp Netapp H300S Firmware - Netapp H500S Firmware - Netapp H700S Firmware - Netapp H410S Firmware -	4
Hardware	Netapp Netapp H300S - Netapp H500S - Netapp H700S - Netapp H410S -	4

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References