VulnerableCode Package Details - pkg:rpm/redhat/curl@7.61.1-33.el8

Search for packages

Vulnerability	Summary	Fixed by
VCID-gnx2-djyk-uyaf Aliases: CVE-2023-38546	Cookie injection with none file This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle does not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.	There are no reported fixed by versions.
VCID-qdcn-2u3v-b3cv Aliases: CVE-2023-46218	Multiple vulnerabilities have been discovered in curl, the worst of which could lead to information disclosure.	There are no reported fixed by versions.
VCID-s73y-y7v7-43cm Aliases: CVE-2023-28322	Multiple vulnerabilities have been discovered in curl, the worst of which could result in arbitrary code execution.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-gnx2-djyk-uyaf
Aliases:
CVE-2023-38546

Cookie injection with none file This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle does not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

There are no reported fixed by versions.

VCID-qdcn-2u3v-b3cv
Aliases:
CVE-2023-46218

Multiple vulnerabilities have been discovered in curl, the worst of which could lead to information disclosure.

There are no reported fixed by versions.

VCID-s73y-y7v7-43cm
Aliases:
CVE-2023-28322

Multiple vulnerabilities have been discovered in curl, the worst of which could result in arbitrary code execution.

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T13:53:54.159011+00:00	RedHat Importer	Affected by	VCID-s73y-y7v7-43cm	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28322.json	38.0.0
2026-04-01T13:51:31.721758+00:00	RedHat Importer	Affected by	VCID-gnx2-djyk-uyaf	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-38546.json	38.0.0
2026-04-01T13:50:54.462604+00:00	RedHat Importer	Affected by	VCID-qdcn-2u3v-b3cv	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-46218.json	38.0.0