CVE-2023-23915: HSTS amnesia with --parallel
Low
C
curl
Submitted None
Actions:
Reported by
nyymi
Vulnerability Details
Technical details and impact analysis
## Summary:
curl overwrites HSTS cache entries if requests are performed in parallel.
## Steps To Reproduce:
1. `curl --parallel --hsts hsts.txt https://site1.tld https://site2.tld https://site3.tld`
Only one of the sites contacted will have entry in `hsts.txt` afterwards. Non-TLS connection to the other sites will not protected by TLS.
## Impact
Request performed over insecure channels unexpectedly and loss of confidentiality and integrity.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cleartext Transmission of Sensitive Information