Vulnerability Details : CVE-2023-28320
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
Vulnerability category: Denial of service
Products affected by CVE-2023-28320
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-28320
0.18%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 56 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-28320
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.9
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
2.2
|
3.6
|
NIST |
CWE ids for CVE-2023-28320
-
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.Assigned by: nvd@nist.gov (Primary)
-
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.Assigned by:
- nvd@nist.gov (Primary)
- support@hackerone.com (Secondary)
References for CVE-2023-28320
-
https://security.netapp.com/advisory/ntap-20230609-0009/
May 2023 cURL/libcURL Vulnerabilities in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://support.apple.com/kb/HT213845
About the security content of macOS Big Sur 11.7.9 - Apple SupportThird Party Advisory
-
https://hackerone.com/reports/1929597
HackerOneExploit;Patch;Third Party Advisory
-
https://support.apple.com/kb/HT213844
About the security content of macOS Monterey 12.6.8 - Apple SupportThird Party Advisory
-
http://seclists.org/fulldisclosure/2023/Jul/52
Full Disclosure: APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9Mailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202310-12
curl: Multiple Vulnerabilities (GLSA 202310-12) — Gentoo securityThird Party Advisory
-
http://seclists.org/fulldisclosure/2023/Jul/48
Full Disclosure: APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8Mailing List;Third Party Advisory
-
https://support.apple.com/kb/HT213843
About the security content of macOS Ventura 13.5 - Apple SupportThird Party Advisory
-
http://seclists.org/fulldisclosure/2023/Jul/47
Full Disclosure: APPLE-SA-2023-07-24-4 macOS Ventura 13.5Mailing List;Third Party Advisory
Jump to