{"answers":{"affected":"It affects 13 products.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38545 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2023-38545 is a high-severity memory corruption vulnerability in Fedoraproject Fedora, published on 18 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2023-38545 and fix it if it is affected.\n\nWhat it is: CVE-2023-38545 is a high-severity memory corruption vulnerability in Fedoraproject Fedora, published on 18 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38545 exists.\n\nAffected product: Fedoraproject Fedora. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-38545/ (Markdown: https://insights.sbomify.com/CVE-2023-38545/index.md)","id":"CVE-2023-38545","markdown":"https://insights.sbomify.com/CVE-2023-38545/index.md","name":"CVE-2023-38545","record":{"aliases":["ALPINE-CVE-2023-38545","AZL-31288","AZL-31501","AZL-34612","AZL-37886","BELL-CVE-2023-38545","CLEANSTART-2026-KI48039","CURL-CVE-2023-38545","DEBIAN-CVE-2023-38545","ECHO-6203-e93c-befd","GHSA-7xw9-w465-6x42","JLSEC-2025-34","RHSA-2024:2011","UBUNTU-CVE-2023-38545","openSUSE-SU-2024:13461-1","openSUSE-SU-2024:13464-1","openSUSE-SU-2024:14085-1"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"curl library","requires_auth":"none","summary":"A heap-based buffer overflow in curl's SOCKS5 proxy handshake allows attackers to execute arbitrary code or cause denial of service via a long hostname.","user_interaction":"required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"hackerone","cpe":[{"product":"fedora","vendor":"fedoraproject"},{"product":"libcurl","vendor":"haxx"},{"product":"windows_10_1809","vendor":"microsoft"},{"product":"windows_10_21h2","vendor":"microsoft"},{"product":"windows_10_22h2","vendor":"microsoft"},{"product":"windows_11_21h2","vendor":"microsoft"},{"product":"windows_11_22h2","vendor":"microsoft"},{"product":"windows_11_23h2","vendor":"microsoft"},{"product":"windows_server_2019","vendor":"microsoft"},{"product":"windows_server_2022","vendor":"microsoft"},{"product":"active_iq_unified_manager","vendor":"netapp"},{"product":"oncommand_insight","vendor":"netapp"},{"product":"oncommand_workflow_automation","vendor":"netapp"}],"cvss":{"score":8.8,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"description":"This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.","ecosystems":["Red Hat:rhel_satellite_client:6::el6","Red Hat:rhel_satellite_client:6::el7","Red Hat:rhel_satellite_client:6::el8","Red Hat:rhel_satellite_client:6::el9","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":"2023-10-11","github_poc":8,"max_poc_stars":21,"metasploit":0,"nuclei":0,"refs":[{"date":"2023-10-17T09:03:15Z","kind":"github_poc","ref":"https://github.com/d0rb/CVE-2023-38545","stars":21,"title":"This script is designed to exploit a heap buffer overflow vulnerability in a socks5 proxy server."},{"date":"2023-10-11T08:11:56Z","kind":"github_poc","ref":"https://github.com/UTsweetyfish/CVE-2023-38545","stars":20,"title":"Simple PoC causing overflow"},{"date":"2023-10-12T07:16:49Z","kind":"github_poc","ref":"https://github.com/imfht/CVE-2023-38545","stars":8,"title":"😄 CVE-2023-38545堆溢出的POC和分析文章"},{"date":"2023-10-12T07:39:15Z","kind":"github_poc","ref":"https://github.com/fatmo666/CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflow","stars":6,"title":"Simple PoC causing overflow"},{"date":"2023-10-16T15:55:32Z","kind":"github_poc","ref":"https://github.com/bcdannyboy/CVE-2023-38545","stars":4,"title":"A proof of concept for testing CVE-2023-38545 against local curl"},{"date":"2023-10-12T16:48:26Z","kind":"github_poc","ref":"https://github.com/vanigori/CVE-2023-38545-sample","stars":3,"title":"Dockerfile containing all the necessary setup files to demo the exploit "},{"date":"2023-10-16T10:04:19Z","kind":"github_poc","ref":"https://github.com/dbrugman/CVE-2023-38545-POC","stars":2,"title":"CVE-2023-38545 POC for the curl command line tool"},{"date":"2024-03-19T13:45:09Z","kind":"github_poc","ref":"https://github.com/Yang-Shun-Yu/CVE-2023-38545","stars":0,"title":null}],"tier":"weaponised"},"has_fix":true,"headline":"Memory corruption in curl","id":"CVE-2023-38545","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"fedoraproject:fedora","products":["fedoraproject:fedora","haxx:libcurl","microsoft:windows_10_1809","microsoft:windows_10_21h2","microsoft:windows_10_22h2","microsoft:windows_11_21h2","microsoft:windows_11_22h2","microsoft:windows_11_23h2","microsoft:windows_server_2019","microsoft:windows_server_2022","netapp:active_iq_unified_manager","netapp:oncommand_insight","netapp:oncommand_workflow_automation"],"type":"memory_corruption","year":"2023"},"n_packages":5,"n_references":13,"next":{"headline":"Information disclosure in curl","id":"CVE-2023-38546"},"packages":[{"ecosystem":"Red Hat:rhel_satellite_client:6::el6","fixed":["0:7.27.0-1.el6sat"],"introduced":["0"],"last_affected":[],"package":"puppet-agent","purl":"pkg:rpm/redhat/puppet-agent","source":"RHSA-2024:2011"},{"ecosystem":"Red Hat:rhel_satellite_client:6::el7","fixed":["0:7.27.0-1.el7sat"],"introduced":["0"],"last_affected":[],"package":"puppet-agent","purl":"pkg:rpm/redhat/puppet-agent","source":"RHSA-2024:2011"},{"ecosystem":"Red Hat:rhel_satellite_client:6::el8","fixed":["0:7.27.0-1.el8sat"],"introduced":["0"],"last_affected":[],"package":"puppet-agent","purl":"pkg:rpm/redhat/puppet-agent","source":"RHSA-2024:2011"},{"ecosystem":"Red Hat:rhel_satellite_client:6::el9","fixed":["0:7.27.0-1.el9sat"],"introduced":["0"],"last_affected":[],"package":"puppet-agent","purl":"pkg:rpm/redhat/puppet-agent","source":"RHSA-2024:2011"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["3.27.8-1.1"],"introduced":["0"],"last_affected":[],"package":"cmake","purl":"pkg:rpm/opensuse/cmake\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2024:13464-1"}],"prev":{"headline":"Missing authorization in Secure Access Linux","id":"CVE-2023-38544"},"products":["curl"],"published":"2023-10-18","related":[{"cvss_score":9.8,"headline":"PHP-CGI OS Command Injection","id":"CVE-2024-4577","kev_date_added":"2024-06-12","published":"2024-06-09"},{"cvss_score":9.8,"headline":"Grafana Authentication Bypass","id":"CVE-2021-39226","kev_date_added":"2022-08-25","published":"2021-10-05"},{"cvss_score":9.8,"headline":"VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow","id":"CVE-2019-5544","kev_date_added":"2021-11-03","published":"2019-12-06"},{"cvss_score":9.6,"headline":"Google Chromium V8 Type Confusion","id":"CVE-2024-4947","kev_date_added":"2024-05-20","published":"2024-05-15"},{"cvss_score":9.6,"headline":"Google Chromium Visuals Use-After-Free","id":"CVE-2024-4671","kev_date_added":"2024-05-13","published":"2024-05-09"},{"cvss_score":9.6,"headline":"Google Chromium Mojo Insufficient Data Validation","id":"CVE-2022-3075","kev_date_added":"2022-09-08","published":"2022-09-26"},{"cvss_score":9.6,"headline":"Google Chromium Indexed DB API Use-After-Free","id":"CVE-2021-30633","kev_date_added":"2021-11-03","published":"2021-10-08"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-14","vendors":["curl"]},"summary":"A heap-based buffer overflow in curl's SOCKS5 proxy handshake allows attackers to execute arbitrary code or cause denial of service via a long hostname.","url":"https://insights.sbomify.com/CVE-2023-38545/"}