Question Security: curl CVE-2023-38545, CVE-2023-38546

[Paul Larson]

Server operating system version

Ubuntu

Plesk version and microupdate number

18.0.54

Are the October 2023 curl vulnerabilities something that would have any root within Plesk, or would those best be handled by an OS (Ubuntu in my case) update?

Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11 · curl/curl · Discussion #12026

We are cutting the release cycle short and will release curl 8.4.0 on October 11, including fixes for a severity HIGH CVE and one severity LOW. The one rated HIGH is probably the worst curl securit...

github.com

 

[Peter Debik]

Sounds like it has to be fixed by the OS vendors.

 

[scsa20]

Like what Peter said, this is managed by OS Vendor. Once the patch is pushed to the package managers for the OS, you can get it updated using apt, yum, or dnf (depending on what OS you're using, since you're using ubuntu it'll be done through apt).