MEDIUM 5.9 Microsoft

CVE-2023-27536

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

Microsoft Security Update 2023-Mar: An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

Affected Products

References

Published: 2023-03-14 · Source: Microsoft · Feed updated: 2026-09-17
This medium severity vulnerability with a CVSS score of 5.9 was published on 2023-03-14 via Microsoft. Affected: azl3 cmake 3.21.4-10 on Azure Linux 3.0, cbl2 curl 8.0.1-1 on CBL Mariner 2.0, cbl2 rust 1.72.0-2 on CBL Mariner 2.0 and 5 more.
vulnfeed aggregates 8294 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.