CVE-2023-38545 is a critical vulnerability affecting the libcurl library, specifically causing a heap-based buffer overflow in the SOCKS5 proxy handshake. This flaw can lead to remote code execution in applications using affected versions of the library, which range from 7.69.0 to 8.3.0. Systems that may be impacted include REST API clients, package managers, web scraping tools, microservices, IoT devices, deployment scripts, CI/CD pipelines, and cloud service interactions. To mitigate this vulnerability, it is recommended to update to libcurl version 8.4.0 or apply the appropriate patch.

How do I know if I'm affected?

If you're using the libcurl library in your applications or devices, you might be affected by this vulnerability. This issue impacts versions of libcurl ranging from 7.69.0 to 8.3.0. Applications and devices that could be affected include REST API clients, package managers, web scraping tools, microservices, IoT devices, deployment scripts, CI/CD pipelines, and cloud service interactions. To check if you're affected, verify the version of libcurl you're using and see if it falls within the mentioned range.

What should I do if I'm affected?

If you're affected by this vulnerability you should update your libcurl to version 8.4.0 or later. Then, avoid using CURLPROXY_SOCKS5_HOSTNAME proxies with curl. Don't set a proxy environment variable to socks5h://.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-38545 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787, which is an Out-of-bounds Write issue in the curl library, causing a heap buffer overflow during the SOCKS5 proxy handshake.

For more details

CVE-2023-38545 is a critical vulnerability affecting the libcurl library, with potential consequences such as remote code execution and system compromise. It is essential to update affected systems to mitigate this high-severity flaw. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• curl - SOCKS5 heap buffer overflow - CVE-2023-38545

• Fedora 37 Update: curl-7.85.0-12.fc37 - package-announce - Fedora Mailing-Lists

• October 2023 MySQL Server Vulnerabilities in NetApp Products | NetApp Product Security

• Discover The High Severity Heap buffer Overflow Vulnerability in cURL (CVE-2023-38545)