CVE-2023-32001: curl: fopen race condition: CVE-2023-32001
REJECT We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for.
Other sources
cURL libcurl could allow a remote authenticated attacker to bypass security restrictions, caused by a race condition in the fopen() function when saving cookie, HSTS and/or alt-svc data to files. By persuading a victim to open a specially crafted content, an attacker could exploit this vulnerability to create or overwrite protected files.
— IBM
libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called stat() followed by fopen() in a way that made it vulnerable to a TOCTOU race condition problem.
By exploiting this flaw, an attacker could trick the victim to create or overwrite protected files holding this data in ways it was not intended to.
Rejected reason: We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-32001?
CVE-2023-32001 is a vulnerability in libcurl that allows an attacker to create or overwrite protected files through a TOCTOU race condition.
What is the severity of CVE-2023-32001?
CVE-2023-32001 has a severity level of medium.
Which software is affected by CVE-2023-32001?
The affected software includes Haxx Libcurl (versions 7.84.0 to 8.1.2), Debian Debian Linux 12.0, and Fedoraproject Fedora 37.
How can an attacker exploit CVE-2023-32001?
An attacker can exploit CVE-2023-32001 by tricking the victim into creating or overwriting protected files.
Where can I find more information about CVE-2023-32001?
You can find more information about CVE-2023-32001 at the following references: - [HackerOne Report](https://hackerone.com/reports/2039870) - [Debian Security Advisory](https://www.debian.org/security/2023/dsa-5460) - [Fedora Project Mailing List](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BGJ7POX4ATGERTSBFJPW2EQH4Z65PSZJ/)