CVE-2023-46218

一、漏洞信息
 漏洞编号：[CVE-2023-46218](https://nvd.nist.gov/vuln/detail/CVE-2023-46218)
 漏洞归属组件：[curl](https://gitee.com/src-openeuler/curl)
 漏洞归属的版本：7.71.1,7.77.0,7.78.0,7.79.1,7.86.0,7.88.1,8.1.2
 CVSS V3.0分值：
  BaseScore：6.5 Medium
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
 漏洞简述：
  This flaw allows a malicious HTTP server to set  super cookies  in curl thatare then passed back to more origins than what is otherwise allowed orpossible. This allows a site to set cookies that then would get sent todifferent and unrelated sites and domains.It could do this by exploiting a mixed case flaw in curl s function thatverifies a given cookie domain against the Public Suffix List (PSL). Forexample a cookie could be set with `domain=co.UK` when the URL used a lowercase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
 漏洞公开时间：2023-12-07 09:15:07
 漏洞创建时间：2023-12-06 16:02:18
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-46218
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| support.hackerone.com | https://curl.se/docs/CVE-2023-46218.html |  |
| support.hackerone.com | https://hackerone.com/reports/2212193 |  |
| support.hackerone.com | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/ |  |
| support.hackerone.com | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/ |  |
| redhat_bugzilla | https://daniel.haxx.se/blog/2023/12/06/curl-8-5-0/ | https://bugzilla.redhat.com/show_bug.cgi?id=2252030 |
| redhat_bugzilla | https://seclists.org/oss-sec/2023/q4/261 | https://bugzilla.redhat.com/show_bug.cgi?id=2252030 |
| curl |  | https://curl.se/docs/CVE-2023-46218.html |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-46218 |
| mageia |  | http://advisories.mageia.org/MGASA-2023-0345.html |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-46218 | https://explore.alas.aws.amazon.com/CVE-2023-46218.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46218 | https://explore.alas.aws.amazon.com/CVE-2023-46218.html |
| snyk | https://github.com/curl/curl/commit/2b0994c29a721c91c57 | https://security.snyk.io/vuln/SNYK-UNMANAGED-CURLCURL-6101840 |
| snyk | https://hackerone.com/reports/2212193 | https://security.snyk.io/vuln/SNYK-UNMANAGED-CURLCURL-6101840 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2252030 | https://security.snyk.io/vuln/SNYK-UNMANAGED-CURLCURL-6101840 |
| snyk | https://curl.se/docs/CVE-2023-46218.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-CURLCURL-6101840 |
| support.hackerone.com | https://curl.se/docs/CVE-2023-46218.html |  |
| support.hackerone.com | https://hackerone.com/reports/2212193 |  |
| support.hackerone.com | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/ |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/curl/curl/commit/2b0994c29a721c91c57 |  | snyk |
| curl |  | https://github.com/curl/curl/commit/2b0994c29a721c91c57 | https://github.com/curl/curl/commit/e77b5b7453c1e8c | curl |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    curl添加cookie时做PSL（Public Suffix List）检查时存在漏洞，会将大小写混合的PSL域名误判断为非PSL域名，导致服务端可以绕过PSL检查添加super cookies，可能造成信息泄露，对机密性存在影响。 
 openEuler评分：
  5.3
 Vector：CVSS：2.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(7.71.1):受影响
2.openEuler-20.03-LTS-SP3(7.71.1):受影响
3.openEuler-20.03-LTS-SP4:受影响
4.openEuler-22.03-LTS(7.79.1):受影响
5.openEuler-22.03-LTS-SP1(7.79.1):受影响
6.openEuler-22.03-LTS-SP2(7.79.1):受影响
7.openEuler-22.03-LTS-SP3:受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(7.71.1):否
2.openEuler-20.03-LTS-SP3(7.71.1):否
3.openEuler-20.03-LTS-SP4:否
4.openEuler-22.03-LTS(7.79.1):否
5.openEuler-22.03-LTS-SP1(7.79.1):否
6.openEuler-22.03-LTS-SP2(7.79.1):否
7.openEuler-22.03-LTS-SP3:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2023-1913

src-openEuler/curl
关闭

内容风险标识

评论 (12)

src-openEuler/curl关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-46218

评论 (12)

搜索帮助

src-openEuler/curl
关闭