Homepage
About Snyk

CVE-2023-46218 Affecting curl package, versions <7.74.0-1.3+deb11u11

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.07% (30th percentile)
Expand this section
NVD
6.5 medium
Expand this section
Red Hat
5.3 medium
Expand this section
SUSE
4.2 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN11-CURL-6100976
  • published 6 Dec 2023
  • disclosed 7 Dec 2023
Report a new vulnerability Found a mistake?

Introduced: 6 Dec 2023

CVE-2023-46218 Open this link in a new tab

How to fix?

Upgrade Debian:11 curl to version 7.74.0-1.3+deb11u11 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.

It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL used a lower case hostname curl.co.uk, even though co.uk is listed as a PSL domain.