CVE-2023-27535

Description

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

How to fix CVE-2023-27535

To remediate CVE-2023-27535, upgrade the affected package to a fixed version below.

• —upgrade to 8.0.1-r0 or later
• —upgrade to 7.74.0-1.3+deb11u8 or later

Is CVE-2023-27535 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 8.0.1-r0
• from 0, < 7.74.0-1.3+deb11u8

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2023-27535
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-27535