CVE-2023-46218

NameCVE-2023-46218
DescriptionThis flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3692-1, DSA-5587-1, ELA-1068-1
Debian Bugs1057646

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
curl (PTS)jessie, jessie (lts)7.38.0-4+deb8u28fixed
stretch (security)7.52.1-5+deb9u16vulnerable
stretch (lts), stretch7.52.1-5+deb9u22fixed
buster, buster (lts)7.64.0-4+deb10u10fixed
buster (security)7.64.0-4+deb10u9fixed
bullseye7.74.0-1.3+deb11u13fixed
bullseye (security)7.74.0-1.3+deb11u14fixed
bookworm7.88.1-10+deb12u8fixed
bookworm (security)7.88.1-10+deb12u5fixed
sid, trixie8.11.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
curlsourcejessie(not affected)
curlsourcestretch7.52.1-5+deb9u21ELA-1068-1
curlsourcebuster7.64.0-4+deb10u8DLA-3692-1
curlsourcebullseye7.74.0-1.3+deb11u11DSA-5587-1
curlsourcebookworm7.88.1-10+deb12u5DSA-5587-1
curlsource(unstable)8.5.0-11057646

Notes

Introduced by: https://github.com/curl/curl/commit/e77b5b7453c1e8ccd7ec0816890d98e2f392e465 (curl-7_46_0)
Fixed by: https://github.com/curl/curl/commit/2b0994c29a721c91c572cff7808c572a24d251eb (curl-8_5_0)
https://curl.se/docs/CVE-2023-46218.html
[jessie] - curl <not-affected> (libpsl support introduced in 7.46.0)

Search for package or bug name: Reporting problems