CVE-2023-38039 is a high-severity vulnerability affecting the curl software, which is used in various systems, including specific versions of Fedora, Microsoft Windows, iOS, and macOS. This vulnerability allows a malicious server to send an endless series of headers, causing curl to run out of heap memory. The issue has been addressed in curl version 8.4.0, and updates have been released for affected systems to mitigate the risk.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, you'll need to check if you're using specific versions of curl software or certain Apple products. Affected curl versions range from 7.84.0 to 8.3.0. For Apple users, the vulnerability impacts iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, iPad Pro 12.9-inch 1st generation, macOS Ventura 13.6.4, and macOS Monterey 12.7.3. If you're using any of these devices or software versions, you may be at risk.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your software or device. For curl users, update to version 8.4.0 or later. Apple users should update their devices to the latest available software: iOS 16.7.5, iPadOS 16.7.5, macOS Ventura 13.6.4, or macOS Monterey 12.7.3. Regularly check for updates and apply them promptly to stay protected.

Is CVE-2023-38039 in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. This issue is related to curl software accepting unlimited headers in an HTTP response. It was published on September 15, 2023. While a specific due date and required action are not provided, updating your software or device to the latest available version is recommended to mitigate the risk.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-770, which is related to curl software not limiting resource allocation allowing malicious servers to cause memory issues. This has been addressed in updates for various Apple devices and software.

For more details

CVE-2023-38039 is a significant vulnerability that affects various systems and devices. For a comprehensive understanding of its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• Full Disclosure: Defense in depth -- the Microsoft way (part 86)

• Full Disclosure: APPLE-SA-01-22-2024-3 iOS 16.7.5 and iPadOS 16.7.5 (1)

• Full Disclosure: APPLE-SA-01-22-2024-6 macOS Ventura 13.6.4 (2)

• Full Disclosure: APPLE-SA-01-22-2024-7 macOS Monterey 12.7.3 (3)