CVE-2023-23914: curl HSTS ignored on multiple requests
Low
C
curl
Submitted None
Actions:
Reported by
nyymi
Vulnerability Details
Technical details and impact analysis
## Summary:
curl tool HSTS doesn't work correctly when performing multiple requests within a single invocation.
## Steps To Reproduce:
1. `curl --hsts "" https://hsts.example.com http://hsts.example.com`
The second request will be performed over HTTP regardless if correct HSTS header is returned by the first request.
## Impact
Request performed over insecure channels unexpectedly and loss of confidentiality and integrity.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cleartext Transmission of Sensitive Information