Update of Curl.exe for Windows Server 2019 - CVE-2023-32001

Question

Update of Curl.exe for Windows Server 2019 - CVE-2023-32001

Sharma, Raju 30

Hi Support team

Nessus found a vulnerability with curl

Curl Arbitrary File Write 7.x >= 7.84.0 / 8.x <= 8.1.2 (CVE-2023-32001) with Windows Server

We have 60 plus Windows Server 2019, and our current version of curl is 8.0.1. Kindly advise when are you going to release next patch to fix this vulnerability.

Thank you.

Mark A. Alderete 0 Reputation points

2023-08-30T19:04:25.2933333+00:00

Waiting for Curl updates for Windows 10/11 and Server.
Brad Bateman 5 Reputation points

2023-08-31T11:54:54.4333333+00:00

+1 I have the same issue.
21038347 0 Reputation points

2023-09-27T01:23:09.8966667+00:00

Hi,

There is a new Curl vulnerability from my Nessus scan also, below:
I read that it is not recommended to manually update the curl separately as it will break windows. When can this CVE below be included in the Microsoft security patch?

Urgent query thanks!

Mark A. Alderete 0 Reputation points

2023-08-30T19:04:25.2933333+00:00

Waiting for Curl updates for Windows 10/11 and Server.
Brad Bateman 5 Reputation points

2023-08-31T11:54:54.4333333+00:00

+1 I have the same issue.
21038347 0 Reputation points

2023-09-27T01:23:09.8966667+00:00

Hi,

There is a new Curl vulnerability from my Nessus scan also, below:
I read that it is not recommended to manually update the curl separately as it will break windows. When can this CVE below be included in the Microsoft security patch?

Urgent query thanks!

Answer 1

Brad Bateman 5

After some research, it looks like this CVE has been retracted by the CURL security team in Aug 2023, and the CVE is in Rejected status now. So this vulnerability should be able to be ignored.

References:

https://curl.se/docs/CVE-2023-32001.html "As of August 2023, the curl security team has retracted this issue and we no longer consider this a curl security flaw."

https://nvd.nist.gov/vuln/detail/CVE-2023-32001 "REJECTED CVE status"

https://www.cve.org/ResourcesSupport/FAQs "A CVE Record listed as “REJECT” is a CVE Record that is not accepted as a CVE Record… As a rule, REJECT CVE Records should be ignored"

Eric Howard 0 Reputation points

2023-08-31T15:25:11.13+00:00

I find their wording in the rejection concerning " ** REJECT ** We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for."

This sounds like they rejected the CVE because there is no way to mitigate the vulnerability.
Mark A. Alderete 0 Reputation points

2023-08-31T15:51:07.1566667+00:00

Thats great to hear. Now if Tenable would update their reporting, so it is not flagged as a critical update.
21038347 0 Reputation points

2023-09-27T01:24:57.35+00:00

Hi,

My nessus scan detected another curl vulnerability below:

I read online that it is highly not recommended to update the curl file separately as it might break windows. When will this CVE remediation be added in the MS Security monthly patch?

Urgent query thanks!
Jason Kennedy 0 Reputation points

2023-09-27T08:12:20.1733333+00:00

Unfortunately the CVE you are referring to is different the one currently reporting is https://curl.se/docs/CVE-2023-38039.html

The issue is still outstanding and marked as High within Tenable

Update of Curl.exe for Windows Server 2019 - CVE-2023-32001

1 answer

Activity