CVE-2023-27533

Name	CVE-2023-27533
Description	A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-3398-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	buster	7.64.0-4+deb10u2	vulnerable
	buster (security)	7.64.0-4+deb10u6	fixed
	bullseye (security), bullseye	7.74.0-1.3+deb11u7	vulnerable
	bookworm, sid	7.88.1-10	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
curl	source	buster	7.64.0-4+deb10u6		DLA-3398-1
curl	source	(unstable)	7.88.1-7

Notes

[bullseye] - curl <no-dsa> (Minor issue)
https://curl.se/docs/CVE-2023-27533.html
Introduced by: https://github.com/curl/curl/commit/a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4 (curl-7_7_alpha2)
Fixed by: https://github.com/curl/curl/commit/538b1e79a6e7b0bb829ab4cecc828d32105d0684 (curl-8_0_0)