Cookie Injection Vulnerability in libcurl by cURL

CVE-2023-38546

What is CVE-2023-38546?

A vulnerability exists in the libcurl library that enables attackers to inject arbitrary cookies into applications using the library. The issue arises when an application duplicates a handle using the curl_easy_duphandle function. If cookies are enabled and the original handle does not source cookies from a disk file, the cloned handle can erroneously reference a non-existent or improperly named file, such as 'none'. If a file by this name exists and is readable in the application's current working directory, it can lead to the inadvertent loading of sensitive cookies, potentially compromising user data and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References