GHSA-3vpc-4p9p-47hc curl_cffi bundles a version of libcurl affected by High Severity vulnerability
Attackers can exploit a bundled vulnerable libcurl version in curl_cffi to potentially execute code or read data via network requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3vpc-4p9p-47hc?
GHSA-3vpc-4p9p-47hc is a vulnerability in curl-cffi, published on 22 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
curl_cffi is potentially affected by High Severity vulnerability (CVE-2023-38545) in libcurl<8.4.0
Details
HIGH severity vulnerability in curl and libcurl: announcement Details are still unknown, but seems it will be a major issue as it's advertised by curl devs as "probably the worst curl security flaw in a long time". A patched version (8.4.0) and details will be published around 06:00 UTC on October 11. curl_cffi wheels on PyPI ship with libcurl 7.84.0
PoC
Resolution
Versions after 0.7 bundles with libcurl>=8.5, which is not affected by this issue.
Which versions are affected by GHSA-3vpc-4p9p-47hc?
2 open source packages ship an affected version, including curl-cffi.
| Package | Affected | Fixed in |
|---|---|---|
curl-cffi PyPI | All versions | 0.7.0b6 |
curl-cffi PyPI | All versions | 0.7.0b6 |
How do I fix GHSA-3vpc-4p9p-47hc?
Upgrade curl-cffi to 0.7.0b6 or later.
Is GHSA-3vpc-4p9p-47hc being exploited?
There is no known exploitation of GHSA-3vpc-4p9p-47hc in the wild and no public exploit code.