CVE-2015-3153
UnknownEPSS 7.54%
Last modified
CVE-2015-3153 is a vulnerability of currently unknown severity. The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.. EPSS estimates a 7.54% chance of exploitation in the next 30 days.
Description
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Enterprise Manager Ops Center | <= 12.1.3 |
| Oracle | Enterprise Manager Ops Center | 12.2.0 |
| Oracle | Enterprise Manager Ops Center | 12.2.1 |
| Oracle | Enterprise Manager Ops Center | 12.3.0 |
| Haxx | Curl | <= 7.42.0 |
| Haxx | Libcurl | <= 7.42.0 |
| Canonical | Ubuntu Linux | 12.04 |
| Canonical | Ubuntu Linux | 14.04 |
| Canonical | Ubuntu Linux | 14.10 |
| Canonical | Ubuntu Linux | 15.1 |
| Apple | Mac Os X | 10.10.4 |
| Debian | Debian Linux | 8.0 |
References
- http://curl.haxx.se/docs/adv_20150429.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlMailing List, Third Party Advisory
- http://www.debian.org/security/2015/dsa-3240Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlPatch, Third Party Advisory
- http://www.securitytracker.com/id/1032233Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2591-1Third Party Advisory
- https://support.apple.com/kb/HT205031Third Party Advisory
- http://curl.haxx.se/docs/adv_20150429.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlMailing List, Third Party Advisory
- http://www.debian.org/security/2015/dsa-3240Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlPatch, Third Party Advisory
- http://www.securitytracker.com/id/1032233Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2591-1Third Party Advisory
- https://support.apple.com/kb/HT205031Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-3153?
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
How severe is CVE-2015-3153?
Severity scoring for CVE-2015-3153 is pending analysis. The EPSS model estimates a 7.54% probability of exploitation in the next 30 days.
How do I fix CVE-2015-3153?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2015-3153?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST