{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"Medium" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"curl security update", "category":"general", "title":"Synopsis" }, { "text":"An update for curl is now available for openEuler-22.03-LTS.", "category":"general", "title":"Summary" }, { "text":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\n\nSecurity Fix(es):\n\nA flaw was found in the Curl package, where the HSTS mechanism could fail when multiple transfers are done in parallel, as the HSTS cache file gets overwritten by the most recently completed transfer. This issue may result in limited confidentiality and integrity.(CVE-2023-23915)\n\nA flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This issue may result in limited confidentiality and integrity.(CVE-2023-23914)\n\ncurl supports \"chained\" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was capped, but the cap was implemented on a per-header basis allowing a malicious server to insert a virtually unlimited number of compression steps simply by using many headers. The use of such a decompression chain could result in a \"malloc bomb\", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.(CVE-2023-23916)", "category":"general", "title":"Description" }, { "text":"An update for curl is now available for openEuler-22.03-LTS.\n\nopenEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"Medium", "category":"general", "title":"Severity" }, { "text":"curl", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2023-1124", "category":"self", "url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1124" }, { "summary":"CVE-2023-23915", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2023-23915&packageName=curl" }, { "summary":"CVE-2023-23914", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2023-23914&packageName=curl" }, { "summary":"CVE-2023-23916", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2023-23916&packageName=curl" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23915" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23914" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23916" }, { "summary":"openEuler-SA-2023-1124 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2023/csaf-openeuler-sa-2023-1124.json" } ], "title":"An update for curl is now available for openEuler-22.03-LTS", "tracking":{ "initial_release_date":"2023-02-24T14:15:55+08:00", "revision_history":[ { "date":"2023-02-24T14:15:55+08:00", "summary":"Initial", "number":"1.0.0" }, { "date":"2024-10-31T14:15:55+08:00", "summary":"final", "number":"2.0.0" } ], "generator":{ "date":"2024-10-31T14:15:55+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2024-10-31T14:15:55+08:00", "id":"openEuler-SA-2023-1124", "version":"2.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"openEuler-22.03-LTS", "name":"openEuler-22.03-LTS" }, "name":"openEuler-22.03-LTS", "category":"product_version" } ], "category":"product_name" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"libcurl-7.79.1-14.oe2203.aarch64.rpm", "name":"libcurl-7.79.1-14.oe2203.aarch64.rpm" }, "name":"libcurl-7.79.1-14.oe2203.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"curl-debugsource-7.79.1-14.oe2203.aarch64.rpm", "name":"curl-debugsource-7.79.1-14.oe2203.aarch64.rpm" }, "name":"curl-debugsource-7.79.1-14.oe2203.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"curl-7.79.1-14.oe2203.aarch64.rpm", "name":"curl-7.79.1-14.oe2203.aarch64.rpm" }, "name":"curl-7.79.1-14.oe2203.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"curl-debuginfo-7.79.1-14.oe2203.aarch64.rpm", "name":"curl-debuginfo-7.79.1-14.oe2203.aarch64.rpm" }, "name":"curl-debuginfo-7.79.1-14.oe2203.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"libcurl-devel-7.79.1-14.oe2203.aarch64.rpm", "name":"libcurl-devel-7.79.1-14.oe2203.aarch64.rpm" }, "name":"libcurl-devel-7.79.1-14.oe2203.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"noarch", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"curl-help-7.79.1-14.oe2203.noarch.rpm", "name":"curl-help-7.79.1-14.oe2203.noarch.rpm" }, "name":"curl-help-7.79.1-14.oe2203.noarch.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"curl-7.79.1-14.oe2203.src.rpm", "name":"curl-7.79.1-14.oe2203.src.rpm" }, "name":"curl-7.79.1-14.oe2203.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"curl-7.79.1-14.oe2203.x86_64.rpm", "name":"curl-7.79.1-14.oe2203.x86_64.rpm" }, "name":"curl-7.79.1-14.oe2203.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"libcurl-devel-7.79.1-14.oe2203.x86_64.rpm", "name":"libcurl-devel-7.79.1-14.oe2203.x86_64.rpm" }, "name":"libcurl-devel-7.79.1-14.oe2203.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"curl-debuginfo-7.79.1-14.oe2203.x86_64.rpm", "name":"curl-debuginfo-7.79.1-14.oe2203.x86_64.rpm" }, "name":"curl-debuginfo-7.79.1-14.oe2203.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"libcurl-7.79.1-14.oe2203.x86_64.rpm", "name":"libcurl-7.79.1-14.oe2203.x86_64.rpm" }, "name":"libcurl-7.79.1-14.oe2203.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS" }, "product_id":"curl-debugsource-7.79.1-14.oe2203.x86_64.rpm", "name":"curl-debugsource-7.79.1-14.oe2203.x86_64.rpm" }, "name":"curl-debugsource-7.79.1-14.oe2203.x86_64.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"libcurl-7.79.1-14.oe2203.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.aarch64", "name":"libcurl-7.79.1-14.oe2203.aarch64 as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"curl-debugsource-7.79.1-14.oe2203.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.aarch64", "name":"curl-debugsource-7.79.1-14.oe2203.aarch64 as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"curl-7.79.1-14.oe2203.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:curl-7.79.1-14.oe2203.aarch64", "name":"curl-7.79.1-14.oe2203.aarch64 as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"curl-debuginfo-7.79.1-14.oe2203.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.aarch64", "name":"curl-debuginfo-7.79.1-14.oe2203.aarch64 as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"libcurl-devel-7.79.1-14.oe2203.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.aarch64", "name":"libcurl-devel-7.79.1-14.oe2203.aarch64 as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"curl-help-7.79.1-14.oe2203.noarch.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:curl-help-7.79.1-14.oe2203.noarch", "name":"curl-help-7.79.1-14.oe2203.noarch as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"curl-7.79.1-14.oe2203.src.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:curl-7.79.1-14.oe2203.src", "name":"curl-7.79.1-14.oe2203.src as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"curl-7.79.1-14.oe2203.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:curl-7.79.1-14.oe2203.x86_64", "name":"curl-7.79.1-14.oe2203.x86_64 as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"libcurl-devel-7.79.1-14.oe2203.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.x86_64", "name":"libcurl-devel-7.79.1-14.oe2203.x86_64 as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"curl-debuginfo-7.79.1-14.oe2203.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.x86_64", "name":"curl-debuginfo-7.79.1-14.oe2203.x86_64 as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"libcurl-7.79.1-14.oe2203.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.x86_64", "name":"libcurl-7.79.1-14.oe2203.x86_64 as a component of openEuler-22.03-LTS" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS", "product_reference":"curl-debugsource-7.79.1-14.oe2203.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.x86_64", "name":"curl-debugsource-7.79.1-14.oe2203.x86_64 as a component of openEuler-22.03-LTS" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2023-23915", "notes":[ { "text":"A flaw was found in the Curl package, where the HSTS mechanism could fail when multiple transfers are done in parallel, as the HSTS cache file gets overwritten by the most recently completed transfer. This issue may result in limited confidentiality and integrity.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-help-7.79.1-14.oe2203.noarch", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.src", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-help-7.79.1-14.oe2203.noarch", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.src", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.x86_64" ], "details":"curl security update", "category":"vendor_fix", "url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1124" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":4.3, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-help-7.79.1-14.oe2203.noarch", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.src", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.x86_64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2023-23915" }, { "cve":"CVE-2023-23914", "notes":[ { "text":"A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This issue may result in limited confidentiality and integrity.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-help-7.79.1-14.oe2203.noarch", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.src", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-help-7.79.1-14.oe2203.noarch", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.src", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.x86_64" ], "details":"curl security update", "category":"vendor_fix", "url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1124" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":4.3, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-help-7.79.1-14.oe2203.noarch", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.src", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.x86_64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2023-23914" }, { "cve":"CVE-2023-23916", "notes":[ { "text":"curl supports chained HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable links in this decompression chain was capped, but the cap was implemented on a per-header basis allowing a malicious server to insert a virtually unlimited number of compression steps simply by using many headers. The use of such a decompression chain could result in a malloc bomb , making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-help-7.79.1-14.oe2203.noarch", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.src", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-help-7.79.1-14.oe2203.noarch", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.src", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.x86_64" ], "details":"curl security update", "category":"vendor_fix", "url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1124" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.aarch64", "openEuler-22.03-LTS:curl-help-7.79.1-14.oe2203.noarch", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.src", "openEuler-22.03-LTS:curl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-devel-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debuginfo-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:libcurl-7.79.1-14.oe2203.x86_64", "openEuler-22.03-LTS:curl-debugsource-7.79.1-14.oe2203.x86_64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2023-23916" } ] }