CVE-2023-28322: curl before 8.1.0 (exclusive); +9 more affected products

Affected technology

curl · before 8.1.0 (exclusive)
haxx

fedora · 37
fedoraproject

fedora · 38
fedoraproject

macos · from 11.0 (inclusive), before 11.7.9 (exclusive)
apple

macos · from 12.0 (inclusive), before 12.6.8 (exclusive)
apple

macos · from 13.0 (inclusive), before 13.5 (exclusive)
apple

clustered data ontap · Version not applicable in the source CPE
netapp

ontap antivirus connector · Version not applicable in the source CPE
netapp

h300s firmware · Version not applicable in the source CPE
netapp

h500s firmware · Version not applicable in the source CPE
netapp

h700s firmware · Version not applicable in the source CPE
netapp

h410s firmware · Version not applicable in the source CPE
netapp

https://github.com/curl/curl · Fixed in 8.1.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could access information they should not be able to access. NVD’s CVSS 3.1 assessment (base score 3.7/10) rates confidentiality impact as low; integrity and availability impact as none. Source advisory’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.