CVE-2023-38545 & CVE-2023-38546

StackCap43382 — Wed, 11 Oct 2023 08:16:49 GMT

More information about CVE-2023-38545 & CVE-2023-38546 has been released.

https://curl.se/docs/CVE-2023-38545.html

Has anyone had any update from CKP about this vulnerability in CURL_CLI or other CKP components?

Re: CVE-2023-38545 & CVE-2023-38546

PhoneBoy — Wed, 11 Oct 2023 14:53:01 GMT

My unofficial take, just from reading, is that you'd probably need expert-level access to even exploit this...and leverage SOCKS5.
We don't leverage SOCKS5 at all for any of our automated uses of this tool.
That makes this vulnerability less of a concern and not something that requires an immediate patch.

Meanwhile, I assume we are investigating this issue formally and will provide an SK soon.

topic CVE-2023-38545 & CVE-2023-38546 in General Topics

CVE-2023-38545 & CVE-2023-38546

Re: CVE-2023-38545 & CVE-2023-38546