Vulnerability Name: CVE-2023-23916 (CCN-247437) Assigned: 2023-02-15 Published: 2023-02-15 Updated: 2023-04-18 Summary: cURL libcurl is vulnerable to a denial of service, caused by a flaw in the decompression chain implementation. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause memory errors, and results in a denial of service condition. CVSS v3 Severity: 6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H 5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): RequiredScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): High
6.5 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H 5.7 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): RequiredScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): High
CVSS v2 Severity: 7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): Complete
Vulnerability Consequences: Denial of Service References: Source: MITRECVE-2023-23916 CVE-2023-23916: HTTP multi-header compression denial of service curl-cve202323916-dos(247437) support@hackerone.com support@hackerone.com support@hackerone.com support@hackerone.com support@hackerone.com IBM QRadar WinCollect agent has multiple vulnerabilities Vulnerabilities in Node.js, libcurl, Golang Go, Jetty, Guava, Netty, OpenSSL, Linux kernel may affect IBM Spectrum Protect Plus IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from libcurl, openssl, gnutls, libarchive and libsepol Multiple publicly disclosed Libcurl vulnerabilities affect IBM Safer Payments IBM MQ is affected by vulnerabilities in libcURL (CVE-2023-23916, CVE-2023-27535) Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. Vulnerability in cURL libcurl affects IBM Process Mining . CVE-2023-23916 IBM Event Streams is affected by a vulnerability in the libcurl package (CVE-2023-23916) Vulnerabilities in Golang, Python, postgresql, cURL libcurl might affect IBM Spectrum Copy Data Management Security vulnerabilities are addressed with IBM Cloud Pak for Business IBM Sterling Partner Engagement Manager is vulnerable to local information disclosure vulnerability due to org.glassfish.jersey.core_jersey-common IBM Cloud Pak for Security includes components with multiple known vulnerabilities Multiple vulnerabilities in Curl affect PowerSC Vulnerabilities in Apache Commons, Tomcat, Go, libcurl, OpenSSL, Python, Node.js, and Linux can affect IBM Spectrum Protect Plus. IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in cURL libcur ( CVE-2023-23916) Multiple vulnerabilities in cURL libcurl affect AIX IBM Security Verify Access Appliance has multiple security vulnerabilities IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to cURL libcurl denial of service vulnerability( CVE-2023-23916) Multiple Vulnerabilities in CloudPak for Watson AIOps CVE-2023-23916 Vulnerable Configuration: Configuration RedHat 1 :cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:* Configuration RedHat 2 :cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:* Configuration CCN 1 :cpe:/a:curl:libcurl:7.57.0:*:*:*:*:*:*:* AND cpe:/a:ibm:spectrum_protect_plus:10.1.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:19.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:20.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:event_streams:10.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:20.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:event_streams:10.1.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:20.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:21.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:21.0.2:-:*:*:*:*:*:* OR cpe:/a:ibm:event_streams:10.3.0:*:*:*:*:*:*:* OR cpe:/a:ibm:event_streams:10.3.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:19.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:19.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:* OR cpe:/a:ibm:spectrum_copy_data_management:2.2.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:* OR cpe:/a:ibm:safer_payments:6.4.0.00:*:*:*:*:*:*:* OR cpe:/a:ibm:safer_payments:6.4.2.02:*:*:*:*:*:*:* OR cpe:/a:ibm:safer_payments:6.5.0.00:*:*:*:*:*:*:* Oval Definitions BACK
curl libcurl 7.57.0
ibm spectrum protect plus 10.1.0
ibm cloud pak for automation 19.0.3
ibm cloud pak for automation 20.0.1
ibm event streams 10.0.0
ibm cloud pak for automation 20.0.2
ibm event streams 10.1.0
ibm cloud pak for automation 20.0.3
ibm cloud pak for automation 21.0.1
ibm cloud pak for automation 21.0.2 -
ibm event streams 10.3.0
ibm event streams 10.3.1
ibm cloud pak for automation 19.0.1
ibm cloud pak for automation 19.0.2
ibm cloud pak for business automation 18.0.0
ibm cloud pak for business automation 18.0.2
ibm cloud pak for business automation 19.0.1
ibm cloud pak for business automation 19.0.3
ibm cloud pak for business automation 20.0.1
ibm cloud pak for business automation 20.0.3
ibm cloud pak for business automation 21.0.1 -
ibm cloud pak for business automation 21.0.2 -
ibm cloud pak for business automation 21.0.3 -
ibm spectrum copy data management 2.2.0.0
ibm robotic process automation for cloud pak 21.0.1
ibm cloud pak for business automation 22.0.1 -
ibm cloud pak for security 1.10.0.0
ibm cloud pak for business automation 22.0.2 -
ibm safer payments 6.4.0.00
ibm safer payments 6.4.2.02
ibm safer payments 6.5.0.00
Denotes that component is vulnerable