Hi Support team Nessus found a vulnerability with curl Curl Arbitrary File Write 7.x >= 7.84.0 / 8.x <= 8.1.2 (CVE-2023-32001) with Windows Server We have 60 plus Windows Server 2019, and our current version of curl is 8.0.1. Kindly advise when are you going to release next patch to fix this vulnerability. Thank you.

After some research, it looks like this CVE has been retracted by the CURL security team in Aug 2023, and the CVE is in Rejected status now. So this vulnerability should be able to be ignored. References: https://curl.se/docs/CVE-2023-32001.html "As of August 2023, the curl security team has retracted this issue and we no longer consider this a curl security flaw." https://nvd.nist.gov/vuln/detail/CVE-2023-32001 "REJECTED CVE status" https://www.cve.org/ResourcesSupport/FAQs "A CVE Record listed as “REJECT” is a CVE Record that is not accepted as a CVE Record… As a rule, REJECT CVE Records should be ignored"

Current Nessus scan shows this as being CVE-2023-38039 as stated above. This is different than CVE-2023-32001. It would nice for Microsoft to actually provide an update for this as it has been an issue for a while. Either way, being on version 7.84 and not on the latest or close to the latest poses an issue just of itself as it was released Jun 27 2022. The latest version of 8.4 having been just release Oct 11 2023. How is MS not at least updating to a build or two behind? I have seen a couple of other threads with the 38039 also listed on MS forums (one example below). None of them have shown or listed any intent of MS releasing an update. [https://learn.microsoft.com/en-us/answers/questions/1387774/curl-7-84-(-8-2-1-header-dos-(cve-2023-38039)-for]( https://learn.microsoft.com/en-us/answers/questions/1387774/curl-7-84-(-8-2-1-header-dos-(cve-2023-38039)-for)

BFB Security has been in touch with the Microsoft Security Response Team regarding the vulnerability. We have received the following response and are awaiting further information from Microsoft as to the expected date of the KB release. Further as with any open source, Microsoft will need to ensure there is a patch cadence as new vulnerabilities are found and new CVEs released. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38545 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38039 As noted there, Microsoft is planning to update these open-source components in Windows. Please watch these two sites for updates. Thank you again for working with MSRC.

Update of Curl.exe for Windows Server 2019 - CVE-2023-32001

Sharma, Raju 80

Hi Support team

Nessus found a vulnerability with curl

Curl Arbitrary File Write 7.x >= 7.84.0 / 8.x <= 8.1.2 (CVE-2023-32001) with Windows Server

We have 60 plus Windows Server 2019, and our current version of curl is 8.0.1. Kindly advise when are you going to release next patch to fix this vulnerability.

Thank you.

Mark A. Alderete 10 Reputation points

2023-08-30T19:04:25.2933333+00:00

Waiting for Curl updates for Windows 10/11 and Server.
Brad Bateman 85 Reputation points

2023-08-31T11:54:54.4333333+00:00

+1 I have the same issue.
21038347 10 Reputation points

2023-09-27T01:23:09.8966667+00:00

Hi,

There is a new Curl vulnerability from my Nessus scan also, below:
I read that it is not recommended to manually update the curl separately as it will break windows. When can this CVE below be included in the Microsoft security patch?

Urgent query thanks!
DaveAdamson 11 Reputation points Microsoft Employee

2023-10-02T15:34:01.39+00:00

Same as above, need CURL updated to 8.3.0 for CVE-2023-38039.
Sharma, Raju 80 Reputation points

2023-10-02T16:08:10.69+00:00

@DaveAdamson Yes! When will Microsoft release the hotfix for this again? Thx.
Zijtveld van, Rogier 0 Reputation points

2023-10-12T10:00:04.6466667+00:00

There is now a new version 8.4.0.. After: https://curl.se/docs/CVE-2023-38545.html
We would like to fix this with a patch
Tiago Santana 0 Reputation points

2023-11-06T18:59:20.6366667+00:00

Hi, someone apply the workaround suggested by Microsoft to mitigate this vulnerability and worked? I tested the Policy, but the Curl keep working after apply the policy and restart the device.
Bruce Bading 15 Reputation points

2023-11-06T20:21:11.23+00:00

BFB Security has been in touch with the Microsoft Security Response Center. They are aware of the vulnerability and are working on a patch cadence for curl. Current supported version is 8.4.0. The workaround is a compensating control that may or may not work, but it will cause problems with PowerShell and Windows Update which rely on curl. Therefore, it is highly recommended that you contact Microsoft Security Response Center @ https://msrc.microsoft.com/report/vulnerability

Only Microsoft can fix the vulnerability as they use the same source code as the vendor and MUST implement a patch cadence to keep curl.exe updated with the monthly patch release. Until that time our SOC is monitoring systems, and we highly recommend implementing the Attack Surface Reduction rules to help mitigate data breaches.

We do not attempt to provide a workable solution, only Microsoft can do that.

Accepted answer

Brad Bateman 85 Reputation points

2023-08-31T12:08:42.7633333+00:00

After some research, it looks like this CVE has been retracted by the CURL security team in Aug 2023, and the CVE is in Rejected status now. So this vulnerability should be able to be ignored.

References:

https://curl.se/docs/CVE-2023-32001.html "As of August 2023, the curl security team has retracted this issue and we no longer consider this a curl security flaw."

https://nvd.nist.gov/vuln/detail/CVE-2023-32001 "REJECTED CVE status"

https://www.cve.org/ResourcesSupport/FAQs "A CVE Record listed as “REJECT” is a CVE Record that is not accepted as a CVE Record… As a rule, REJECT CVE Records should be ignored"
Please sign in to rate this answer.

2 people found this answer helpful.
Eric Howard 0 Reputation points

2023-08-31T15:25:11.13+00:00

I find their wording in the rejection concerning " ** REJECT ** We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for."

This sounds like they rejected the CVE because there is no way to mitigate the vulnerability.

Mark A. Alderete 10 Reputation points

2023-08-31T15:51:07.1566667+00:00

Thats great to hear. Now if Tenable would update their reporting, so it is not flagged as a critical update.

21038347 10 Reputation points

2023-09-27T01:24:57.35+00:00

Hi,

My nessus scan detected another curl vulnerability below:

I read online that it is highly not recommended to update the curl file separately as it might break windows. When will this CVE remediation be added in the MS Security monthly patch?

Urgent query thanks!

Jason Kennedy 5 Reputation points

2023-09-27T08:12:20.1733333+00:00

Unfortunately the CVE you are referring to is different the one currently reporting is https://curl.se/docs/CVE-2023-38039.html

The issue is still outstanding and marked as High within Tenable

Elmest Riveraguzman 0 Reputation points

2023-10-03T17:54:13.35+00:00

This is an active issue. CURL itself released the update to version 8.3.0. but since it is included with every windows installation a patch should be release via windows update.

Zijtveld van, Rogier 0 Reputation points

2023-10-12T09:59:44.1966667+00:00

There is now a new version 8.4.0.. After: https://curl.se/docs/CVE-2023-38545.html
We would like to fix this with a patch

Harold Jensen 0 Reputation points

2023-10-23T16:08:36.31+00:00

What about for this CVE as Curl is showing up again in the scans?
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38545
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

2 additional answers

John Knepler 5 Reputation points

2023-10-24T20:10:35.5366667+00:00

Current Nessus scan shows this as being CVE-2023-38039 as stated above. This is different than CVE-2023-32001. It would nice for Microsoft to actually provide an update for this as it has been an issue for a while. Either way, being on version 7.84 and not on the latest or close to the latest poses an issue just of itself as it was released Jun 27 2022. The latest version of 8.4 having been just release Oct 11 2023. How is MS not at least updating to a build or two behind? I have seen a couple of other threads with the 38039 also listed on MS forums (one example below). None of them have shown or listed any intent of MS releasing an update.

[https://learn.microsoft.com/en-us/answers/questions/1387774/curl-7-84-(-8-2-1-header-dos-(cve-2023-38039)-for](https://learn.microsoft.com/en-us/answers/questions/1387774/curl-7-84-(-8-2-1-header-dos-(cve-2023-38039)-for)
Please sign in to rate this answer.

1 person found this answer helpful.
Harold Jensen 0 Reputation points

2023-10-27T12:51:51.47+00:00

See also CVE-2023-38545. This issue is getting worse by the day.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Bruce Bading 15 Reputation points

2023-10-26T19:07:30.0666667+00:00

BFB Security has been in touch with the Microsoft Security Response Team regarding the vulnerability. We have received the following response and are awaiting further information from Microsoft as to the expected date of the KB release. Further as with any open source, Microsoft will need to ensure there is a patch cadence as new vulnerabilities are found and new CVEs released.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38545

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38039

As noted there, Microsoft is planning to update these open-source components in Windows. Please watch these two sites for updates.

Thank you again for working with MSRC.
Please sign in to rate this answer.

1 person found this answer helpful.
Bruce Bading 15 Reputation points

2023-11-07T01:59:11.0133333+00:00

Curl > 8.4 CVE-2023-38545 has now been elevated to Critical and is being tracked by the NVD. While the severity is being evaluated and may be changed, curl must undergo a regular patch cadence. While we understand that this is in pre-release status, we urge Microsoft to consider putting curl in the regular monthly patch updates along with the kernel and other aspects of the OS. Please refer to the following NVD https://nvd.nist.gov/vuln/detail/CVE-2023-38545.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Update of Curl.exe for Windows Server 2019 - CVE-2023-32001

2 additional answers

Your answer