Curl 7.84 <= 8.2.1 Header DoS (CVE-2023-38039) for Windows 10 and Windows 11 OS

Question

Curl 7.84 <= 8.2.1 Header DoS (CVE-2023-38039) for Windows 10 and Windows 11 OS

Torres pimentel, Rogelio 80

Tenable Vulnerability scanner is detectong a CURL vulnerable version... Microsoft best practice Recomendation states that this package should not be upgraded manually, because that could break Windows update processes.

Tenable Vulnerability: Curl 7.84 <= 8.2.1 Header DoS (CVE-2023-38039)

Reference: https://www.tenable.com/plugins/nessus/181409

Solution Proposed: Upgrade Curl to version 8.3.0 or later

Any idea when Microsoft is going to release CURL Version 8.3.0 as a fix for Windows 10 and Windows 11 OS vulnerability CVE-2023-38039?

MUTHUKARUPPIAH MUTHUKUMAR 10 Reputation points

2023-10-17T08:35:05.81+00:00
Tenable Vulnerability:Curl 7.89 < 8.4.0 Heap Buffer Overflow

Plugin :182875

Any idea when Microsoft is going to release CURL Version 8.4.0

Plugin Output: Path : C:\Windows\SysWOW64\curl.exe Installed version : 8.0.1.0 Fixed version : 8.4.0 Path : C:\Windows\System32\curl.exe Installed version : 8.0.1.0 Fixed version : 8.4.0
Mike Varga 5 Reputation points

2023-10-17T20:56:04.84+00:00

This is an issue with Microsoft's use of open source solutions, without integration of the open source patching. I'd really like to know when/if they plan on fixing this, or if anyone has found a viable open source way of fixing this.
Camenzind Marcel 10 Reputation points

2023-11-03T10:46:01.8533333+00:00

Just got answer from MS Support:

Microsoft is actively working to release version 8.4.0 of curl.exe in a future Windows update to address CVE-2023-38039 and CVE-2023-38545.

For further details, including answers to anticipated questions and workarounds, please review:

Microsoft Security Update Gulde: CVE-2023-38039 | Hackerone: CVE-2023-38039 HTTP headers eat all memory

Microsoft Security Update Gulde: CVE-2023-38545 | MITRE: CVE-2023-38545 SOCKS5 heap buffer overflow

Wait now for answer if it is included in the November Updates
Rogelio Torres Pimentel 0 Reputation points

2023-11-22T15:41:29.86+00:00

You are correct November Patches finnally include this CURL Update, Wjat I am going to do going forward is to Re-cast in Tenable for 1 month every time a new CURL is released, it seems that Microsoft takes 1 patching and even 2 cycles to provide an upgrade of CURL. but November patch does include the latest CURM upgrade.

4 answers

Your answer

MUTHUKARUPPIAH MUTHUKUMAR 10 Reputation points

2023-10-17T08:35:05.81+00:00

Tenable Vulnerability:Curl 7.89 < 8.4.0 Heap Buffer Overflow

Plugin :182875

Any idea when Microsoft is going to release CURL Version 8.4.0

Plugin Output: Path : C:\Windows\SysWOW64\curl.exe Installed version : 8.0.1.0 Fixed version : 8.4.0 Path : C:\Windows\System32\curl.exe Installed version : 8.0.1.0 Fixed version : 8.4.0
Mike Varga 5 Reputation points

2023-10-17T20:56:04.84+00:00

This is an issue with Microsoft's use of open source solutions, without integration of the open source patching. I'd really like to know when/if they plan on fixing this, or if anyone has found a viable open source way of fixing this.
Camenzind Marcel 10 Reputation points

2023-11-03T10:46:01.8533333+00:00

Just got answer from MS Support:

Microsoft is actively working to release version 8.4.0 of curl.exe in a future Windows update to address CVE-2023-38039 and CVE-2023-38545.

For further details, including answers to anticipated questions and workarounds, please review:

Microsoft Security Update Gulde: CVE-2023-38039 | Hackerone: CVE-2023-38039 HTTP headers eat all memory

Microsoft Security Update Gulde: CVE-2023-38545 | MITRE: CVE-2023-38545 SOCKS5 heap buffer overflow

Wait now for answer if it is included in the November Updates
Rogelio Torres Pimentel 0 Reputation points

2023-11-22T15:41:29.86+00:00

You are correct November Patches finnally include this CURL Update, Wjat I am going to do going forward is to Re-cast in Tenable for 1 month every time a new CURL is released, it seems that Microsoft takes 1 patching and even 2 cycles to provide an upgrade of CURL. but November patch does include the latest CURM upgrade.

Answer 1

Jez 10

Another vulnerability has been released for CURL on October 11th.
Still not even an acknowledgment from MS about its existence and no update in the October cumulative for the previous one.

Really could do with a real person saying something helpful rather than an AI bot that knows nothing.

Donald Jackson 25 Reputation points

2023-10-13T15:55:05.0133333+00:00

So... I saw this article on Monday. I too am seeing these vulnerabilities in my Nessus scans and I need to know how to fix it... is this a manual fix that I need to get from "cURL or is MS going to push a fix as suggested in the article?

https://thehackernews.com/2023/10/security-patch-for-two-new-flaws-in.html

Answer 2

Q&A Assist

AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

I don't know. The provided context does not contain information about when Microsoft will release CURL version 8.3.0 as a fix for the Windows 10 and Windows 11 OS vulnerability CVE-2023-38039.

Answer 3

John Knepler 5

Same issue. Would be nice if MS would at least update it to a version or two behind at a minimum rather than being on a version that is over a year old.

Answer 4

Aneesh Kurian 0

Same issue. Is there any update on the patch release. 8.4 on windows 11

Camenzind Marcel 10 Reputation points

2023-11-22T15:23:04.49+00:00

In the November Windows Updates Curl 8.4 is included, so after the Update the problem is solved :-)

Share via

Curl 7.84 <= 8.2.1 Header DoS (CVE-2023-38039) for Windows 10 and Windows 11 OS

4 answers

Your answer