Loading HuntDB...

CVE-2023-23915: HSTS amnesia with --parallel

Low
C
curl
Submitted None
Reported by nyymi

Vulnerability Details

Technical details and impact analysis

Cleartext Transmission of Sensitive Information
## Summary: curl overwrites HSTS cache entries if requests are performed in parallel. ## Steps To Reproduce: 1. `curl --parallel --hsts hsts.txt https://site1.tld https://site2.tld https://site3.tld` Only one of the sites contacted will have entry in `hsts.txt` afterwards. Non-TLS connection to the other sites will not protected by TLS. ## Impact Request performed over insecure channels unexpectedly and loss of confidentiality and integrity.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Cleartext Transmission of Sensitive Information