Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 6 Dec 2023 08:29:50 +0100 (CET)
From: Daniel Stenberg <>
To: curl security announcements -- curl users <>,, libcurl hacking <>,
Subject: [SECURITY ADVISORY] curl: HSTS long file name clears contents

HSTS long file name clears contents

Project curl Security Advisory, December 6 2023 -


When saving HSTS data to an excessively long file name, curl could end up
removing all contents, making subsequent requests using that file unaware of
the HSTS status they should otherwise use.


The reason for this bug is that save function appended a suffix to the file
name, created a temporary file and then in the last step renamed that to the
final name. When the file name length was close to the limit of what is
allowed on the file system, adding the extension would make it too long and
then trigger this bug.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2023-46219 to this issue.

CWE-311: Missing Encryption of Sensitive Data

Severity: Low


- Affected versions: curl 7.84.0 to and including 8.4.0
- Not affected versions: curl < 7.84.0 and >= 8.5.0
- Introduced-in:

libcurl is used by many applications, but not always advertised as such!

This flaw is also accessible using the curl command line tool.


Starting in curl 8.5.0, the temporary file name made done using a pure random
sequence of letters instead of being based on the original.

- Fixed-in:


  A - Upgrade curl to version 8.5.0

  B - Apply the patch to your local version

  C - Do not use HSTS


This issue was reported to the curl project on November 2, 2023. We contacted
distros@...nwall on November 28, 2023.

curl 8.5.0 was released on December 6 2023, coordinated with the publication
of this advisory.


- Reported-by: Maksymilian Arciemowicz
- Patched-by: Daniel Stenberg

Thanks a lot!



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.