Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
curlcffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curlcffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. Details The issue comes from how curlcffi handles outbound requests - User-supplied URLs are passed directly to libcurl without checking whether they resolve to internal IP ranges (e.g., 127.0.0.1, 169.254.0.0/16). - Redirects are automatically followed (CURLOPTFOLLOWLOCATION = 1) inside libcurl. - There is no validation of redirect destinations at the Python layer. This means that even if an application only allows requests to external URLs, an attacker can - Provide a URL pointing to an attacker-controlled server - Return a redirect response pointing to an internal service - Have…
Recommended action: Upgrade to 0.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
curlcffi is potentially affected by High Severity vulnerability (CVE-2023-38545) in libcurl<8.4.0 Details HIGH severity vulnerability in curl and libcurl: announcement Details are still unknown, but seems it will be a major issue as it's advertised by curl devs as "probably the worst curl security flaw in a long time". A patched version (8.4.0) and details will be published around 06:00 UTC on October 11. curlcffi wheels on PyPI ship with libcurl 7.84.0 PoC https://inspector.pypi.io/project/curl-cffi/0.5.10b2/packages/56/ae/eb7d39ad234f1f44650b910757d5aa696feff413d327c8328223ce78cb76/curlcffi-0.5.10b2-cp37-abi3-manylinux217aarch64.manylinux2014aarch64.whl/curlcffi/include/curl/curlver.h Resolution Versions after 0.7 bundles with libcurl=8.5, which is not affected by this issue.
Recommended action: Upgrade to 0.7.0b6 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.