Loading HuntDB...

CVE-2023-23914: curl HSTS ignored on multiple requests

Low
C
curl
Submitted None
Reported by nyymi

Vulnerability Details

Technical details and impact analysis

Cleartext Transmission of Sensitive Information
## Summary: curl tool HSTS doesn't work correctly when performing multiple requests within a single invocation. ## Steps To Reproduce: 1. `curl --hsts "" https://hsts.example.com http://hsts.example.com` The second request will be performed over HTTP regardless if correct HSTS header is returned by the first request. ## Impact Request performed over insecure channels unexpectedly and loss of confidentiality and integrity.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Cleartext Transmission of Sensitive Information