CVE-2023-46219 Fedoraproject CVE debrief

Who should care

Administrators and developers who use curl with HSTS storage enabled, especially in environments where curl writes HSTS data to files that may be influenced by long paths or long file names. Fedora 38 is explicitly listed as affected in the NVD CPE data, and curl versions from 7.84.0 up to but not including 8.5.0 are marked vulnerable.

Technical summary

NVD describes the issue as a file-handling problem in curl’s HSTS persistence path. When curl saves HSTS data to an excessively long file name, the HSTS file can end up emptied, which means later requests using that file may not apply the expected HSTS state. The NVD record maps the weakness to CWE-311 and lists the CVSS vector as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Defensive priority

Medium. The issue is not rated as high or critical, but it can silently weaken HSTS enforcement by erasing persisted state. Prioritize remediation in systems that depend on curl for security-sensitive HTTPS upgrade behavior or that automate file-based HSTS storage.

Recommended defensive actions

• Upgrade curl to a version that is not in the vulnerable range shown by NVD (7.84.0 through before 8.5.0).
• Check distributions and packages that bundle curl, including Fedora 38, for vendor backports or fixed builds.
• Review any automation that writes curl HSTS data to disk and ensure file and path lengths are constrained.
• After updating, verify that HSTS persistence still behaves as expected in your deployment.
• Track vendor advisories linked in the record, especially the curl advisory, for package-specific remediation guidance.

Evidence notes

This debrief is based only on the supplied CVE metadata and the linked official references listed in the record. The source description states that saving HSTS data to an excessively long file name can remove all contents of the HSTS file. NVD marks curl as affected from 7.84.0 up to before 8.5.0 and lists Fedora 38 as vulnerable via CPE criteria. The record also provides the curl vendor advisory, a HackerOne report, and downstream advisories from Fedora, NetApp, Debian, and Siemens as corroborating references.

Official resources