CVE-2023-27533
Published on: Not Yet Published
Last Modified on: 04/21/2023 11:15:00 PM UTC
Certain versions of Curl from Haxx contain the following vulnerability:
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.
- CVE-2023-27533 has been assigned by
suppor[email protected] to track the vulnerability - currently rated as HIGH severity.
CVSS3 Score: 8.8 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | NONE | REQUIRED |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| CVE-2023-27533 cURL/libcURL Vulnerability in NetApp Products | NetApp Product Security | security.netapp.com text/html |
CONFIRM security.netapp.com/advisory/ntap-20230420-0011/ |
| [SECURITY] [DLA 3398-1] curl security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20230421 [SECURITY] [DLA 3398-1] curl security update |
| HackerOne | hackerone.com text/html |
MISC hackerone.com/reports/1891474 |
| [SECURITY] Fedora 36 Update: curl-7.82.0-14.fc36 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org text/html |
FEDORA FEDORA-2023-7e7414e64d |
Related QID Numbers
- 181748 Debian Security Update for curl (DLA 3398-1)
- 184182 Debian Security Update for curl (CVE-2023-27533)
- 199246 Ubuntu Security Notification for curl Vulnerabilities (USN-5964-1)
- 283820 Fedora Security Update for curl (FEDORA-2023-2884ba1528)
- 283865 Fedora Security Update for curl (FEDORA-2023-7e7414e64d)
- 284222 Fedora Security Update for curl (FEDORA-2023-0de03a9232)
- 330140 IBM AIX Multiple Vulnerabilities due to curl (curl_advisory2)
- 354900 Amazon Linux Security Advisory for curl : ALAS-2023-1727
- 355077 Amazon Linux Security Advisory for curl : AL2012-2023-401
- 355390 Amazon Linux Security Advisory for curl : ALAS2-2023-2070
- 355415 Amazon Linux Security Advisory for curl : ALAS2023-2023-193
- 378599 Splunk Enterprise Third Party Package Updates for June (SVD-2023-0613)
- 378883 Splunk Enterprise August Third Party Package Updates (SVD-2023-0808)
- 502707 Alpine Linux Security Update for curl
- 502720 Alpine Linux Security Update for curl
- 503104 Alpine Linux Security Update for curl
- 672889 EulerOS Security Update for curl (EulerOS-SA-2023-1816)
- 672907 EulerOS Security Update for curl (EulerOS-SA-2023-1798)
- 672973 EulerOS Security Update for curl (EulerOS-SA-2023-1838)
- 672997 EulerOS Security Update for curl (EulerOS-SA-2023-1862)
- 673091 EulerOS Security Update for curl (EulerOS-SA-2023-2188)
- 691088 Free Berkeley Software Distribution (FreeBSD) Security Update for curl (0d7d104c-c6fb-11ed-8a4b-080027f5fec9)
- 753819 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2023:0865-1)
- 753857 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2023:1711-1)
- 754020 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2023:2226-1)
- 754021 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2023:2228-1)
- 906769 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (25894-1)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Haxx | Curl | All | All | All | All |
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @h1Disclosed |
⚡ CVE-2023-27533: TELNET option IAC injection ?? nyymi ➟ Internet Bug Bounty ? Low ? $480.0… twitter.com/i/web/status/1… | 2023-03-20 21:32:03 |
| @sidfm_jp |
cURL の TELNET プロトコルの処理に意図しないネゴシエーションを実行する問題 (CVE-2023-27533) [45445] sid.softek.jp/content/show/4… #SIDfm #脆弱性情報 | 2023-03-22 06:30:03 |
| @h1Disclosed |
⚡ CVE-2023-27533: Telnet option IAC injection ?? nyymi ➟ curl ? Low ? N/A hackerone.com/reports/1891474 #bugbounty… twitter.com/i/web/status/1… | 2023-03-22 19:32:32 |
| @SK_Expert |
curl: CVE-2023-27533: Telnet option IAC injection ift.tt/TN0Zuw9 #cyber #awareness #threatintell #CTI… twitter.com/i/web/status/1… | 2023-03-22 21:30:11 |
| @HackenProof |
12/ Title: CVE-2023-27533: Telnet option IAC injection Link: hackerone.com/reports/1891474 Timestamp: disclosed 21 hrs… twitter.com/i/web/status/1… | 2023-03-23 16:34:24 |
| @CVEreport |
CVE-2023-27533 : A vulnerability in input validation exists in curl <8.0 during communication using the TELNET prot… twitter.com/i/web/status/1… | 2023-03-30 20:04:55 |
 /r/netcve |
CVE-2023-27533 | 2023-03-30 20:38:49 |