CVE-2023-27537
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
CVE-2023-27537
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-27537
https://github.com/curl/curl
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "n/a",
"product": "https://github.com/curl/curl",
"versions": [
{
"status": "affected",
"version": "Fixed in 8.0.0"
}
]
}
]- Related CVEs
- CVE-2023-27537
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #24321 · Revision 1
- Added to Heist Feed
- Publisher date