Homepage
About Snyk

Information Exposure Affecting libcurl package, versions <0:8.3.0-1.amzn2.0.5

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.07% (30th percentile)
Expand this section
NVD
6.5 medium
Expand this section
Red Hat
5.3 medium
Expand this section
SUSE
4.2 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-AMZN2-LIBCURL-6148999
  • published 10 Jan 2024
  • disclosed 7 Dec 2023
Report a new vulnerability Found a mistake?

Introduced: 7 Dec 2023

CVE-2023-46218 Open this link in a new tab
CWE-201 Open this link in a new tab

How to fix?

Upgrade Amazon-Linux:2 libcurl to version 0:8.3.0-1.amzn2.0.5 or higher.
This issue was patched in ALAS2-2024-2385.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2 relevant fixed versions and status.

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.

It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL used a lower case hostname curl.co.uk, even though co.uk is listed as a PSL domain.