CVE-2023-27535

Medium

Advisory

Published 20 Mar 2023In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.016; 75th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 664; of 17,787 indexed, latest versions
Container images: 595; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: curl security update

Carried by container images the latest versions of 664 of 17,787 indexed charts deploy, on 595 images.

Affected package	Affected versions	Fixed in	Images
curldeb	7.35.0-1ubuntu2.1, 7.35.0-1ubuntu2.3, 7.35.0-1ubuntu2.16, 7.35.0-1ubuntu2.19+48 more	7.35.0-1ubuntu2.20+esm15, 7.47.0-1ubuntu2.19+esm8, 7.58.0-2ubuntu3.24, 7.68.0-1ubuntu2.18+1 more	294
curlapk	7.77.0-r1, 7.78.0-r0, 7.79.1-r0, 7.79.1-r1+19 more	7.88.1-r1, 8.0.1-r0	162
curlrpm	7.61.1-8.el8, 7.61.1-11.el8, 7.61.1-12.el8, 7.61.1-12.el8_2.4+15 more	0:7.61.1-30.el8_8.2, 0:7.76.1-23.el9_2.1	139

OSV records: ALPINE-CVE-2023-27535 RHSA-2023:2650 RHSA-2023:3106 UBUNTU-CVE-2023-27535 RLSA-2023:3106
Also known as: USN-5964-1, USN-5964-2

Charts affected

664 by stars

Chart

Latest

Affected images

Radar Score

wbaas-backupwbstack

0.1.0

1 of 1 See more

wbaas-backup wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	curl@7.58.0-2ubuntu3.18	7.58.0-2ubuntu3.24

Open the chart page →

9,743

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	curl@7.61.1-18.el8	0:7.61.1-30.el8_8.2

Open the chart page →

28,605

generic-webhookwebhooks

0.1.1

1 of 1 See more

generic-webhook webhooks 0.1.1

1 of the 1 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
ghcr.io/thecatlady/webhook :2.8.0	f04718704dab	curl@7.87.0-r2	7.88.1-r1

Open the chart page →

2,030

webresourcecataloguswebresourcecatalogus

1.1.0

1 of 4 See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	curl@7.80.0-r0	8.0.1-r0

Open the chart page →

7,552

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	curl@7.58.0-2ubuntu3.9	7.58.0-2ubuntu3.24

Open the chart page →

10,843

frpcwenerme

1.0.1

1 of 1 See more

3,359

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18

Open the chart page →

15,230

miniowenerme

8.0.10

1 of 1 See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	curl@7.61.1-14.el8_3.1	0:7.61.1-30.el8_8.2

Open the chart page →

6,915

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	curl@7.61.1-22.el8	0:7.61.1-30.el8_8.2

Open the chart page →

6,138

workadventureworkadventure

1.1.0

2 of 9 See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-chat :v1.17.7	da12f37e6795	curl@7.80.0-r1	8.0.1-r0
thecodingmachine/workadventure-ejabberd :v1.17.7	01df99622ad3	curl@7.80.0-r5	8.0.1-r0

Open the chart page →

16,083

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	curl@7.61.1-22.el8	0:7.61.1-30.el8_8.2

Open the chart page →

11,577

default-backendwyrihaximusnet

1.1.0

1 of 1 See more

default-backend wyrihaximusnet 1.1.0

1 of the 1 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
ghcr.io/wyrihaximusnet/default-backend :random	b24e63efd841	curl@7.79.1-r0	8.0.1-r0

Open the chart page →

2,534

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	curl@7.61.1-25.el8_7.1	0:7.61.1-30.el8_8.2

Open the chart page →

6,016

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2023-27535.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	curl@7.61.1-25.el8_7.3	0:7.61.1-30.el8_8.2

Open the chart page →

3,697

Container images carrying it

595 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
krtk6160/galoy-nostr	cc82a694f818	curl@7.87.0-r2	7.88.1-r1	2
lachlanevenson/k8s-kubectl :v1.25.4	af5cea3f2e40	curl@7.86.0-r1	7.88.1-r1	2
library/cassandra :3.11.6	5aa8400b4b3b	curl@7.58.0-2ubuntu3.9	7.58.0-2ubuntu3.24	2
library/elasticsearch :7.17.3	5e6ac15bf6a5	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	2
library/mongo :4.2.3	58b25d51baa1	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24	2
lightstep/collector :2021-01-26_23-02-36Z	11c5569aaf3b	curl@7.47.0-1ubuntu2.12	7.47.0-1ubuntu2.19+esm8	2
mesosphere/kubeaddons-catalog :v0.11.4	073db43d0b8b	curl@7.68.0-1ubuntu2.2	7.68.0-1ubuntu2.18	2
metabase/metabase :v0.45.2	1fb334ce4820	curl@7.87.0-r1	7.88.1-r1	2
minio/operator :v4.3.7	54393e03f3b2	curl@7.61.1-22.el8	0:7.61.1-30.el8_8.2	2
obsidiandynamics/kafdrop :3.30.0	5337c9e0e2de	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	2
omecproject/mcord-synchronizer :comac-1.0.0	cfdb566dd949	curl@7.47.0-1ubuntu2.12	7.47.0-1ubuntu2.19+esm8	2
phpipam/phpipam-cron :v1.5.2	f770577cb946	curl@7.80.0-r6	8.0.1-r0	2
phpipam/phpipam-www :v1.5.2	3c6fd1332aeb	curl@7.80.0-r6	8.0.1-r0	2
piomin/sample-spring-kotlin-microservice :1.1	871f784dd6bc	curl@7.81.0-1ubuntu1.4	7.81.0-1ubuntu1.10	2
stakater/stakater-nordmart-review :1.0.35	954d2be66e95	curl@7.61.1-22.el8_6.3	0:7.61.1-30.el8_8.2	2
svtechnmaa/svtech_debuger :v1.0.0	b2987abe57d3	curl@7.81.0-1ubuntu1.2	7.81.0-1ubuntu1.10	2
wurstmeister/zookeeper :latest	7a7fd44a7210	curl@7.35.0-1ubuntu2.1	7.35.0-1ubuntu2.20+esm15	2
gcr.io/google_containers/kubernetes-dashboard-init-amd64 :v1.0.0	fbe12aa24de6	curl@7.47.0-1ubuntu2.2	7.47.0-1ubuntu2.19+esm8	2
ghcr.io/codingducksrl/laravel :8.1	5be52524664c	curl@7.81.0-1ubuntu1.6	7.81.0-1ubuntu1.10	2
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	curl@7.81.0-1ubuntu1.3	7.81.0-1ubuntu1.10	2
ghcr.io/games-on-whales/retroarch :1.0.0	103fbcec2314	curl@7.68.0-1ubuntu2.6	7.68.0-1ubuntu2.18	2
ghcr.io/linuxserver/openvpn-as :version-2.8.6-916f8e7d-ubuntu18	4ee0764310e7	curl@7.58.0-2ubuntu3.10	7.58.0-2ubuntu3.24	2
ghcr.io/salaboy/fmtok8s-frontend :v0.1.1	03fd01b4f56e	curl@7.81.0-1ubuntu1.2	7.81.0-1ubuntu1.10	2
ghcr.io/thecatlady/webhook :2.8.0	f04718704dab	curl@7.87.0-r2	7.88.1-r1	2
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	curl@7.80.0-r1	8.0.1-r0	2
quay.io/iver-wharf/wharf-web :v1.6.2	dc5d1ed91c26	curl@7.80.0-r1	8.0.1-r0	2
quay.io/keycloak/keycloak :20.0	054ef67eb7da	curl@7.61.1-25.el8_7.1	0:7.61.1-30.el8_8.2	2
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	curl@7.61.1-22.el8	0:7.61.1-30.el8_8.2	2
quay.io/minio/mc :RELEASE.2023-01-28T20-29-38Z	ad34abeba912	curl@7.61.1-25.el8_7.1	0:7.61.1-30.el8_8.2	2
quay.io/minio/minio :RELEASE.2023-02-10T18-48-39Z	a0a002cb113c	curl@7.61.1-25.el8_7.1	0:7.61.1-30.el8_8.2	2
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	curl@7.61.1-18.el8	0:7.61.1-30.el8_8.2	2
quay.io/openshift/origin-cli :4.7	464a3af4dfe0	curl@7.61.1-18.el8_4.2	0:7.61.1-30.el8_8.2	2
quay.io/openshift/origin-cli :4.8	bb5e052770e5	curl@7.61.1-18.el8_4.2	0:7.61.1-30.el8_8.2	2
adwerx/github-actions-runner :2.276.1-20.04-1	840d2b078682	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.18	1
ahmedinfraplus/simple-app :STAGING	c50e6e81a637	curl@7.83.1-r2	8.0.1-r0	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.18	1
akaunting/akaunting :3.1.21-fpm-alpine-nginx	e7d5c245b1a0	curl@7.80.0-r3	8.0.1-r0	1
allegroai/clearml-agent-k8s-base :1.24-21	772827a01bb5	curl@7.58.0-2ubuntu3.19	7.58.0-2ubuntu3.24	1
alpine/git :2.36.3	66b210a97bc0	curl@7.83.1-r4	8.0.1-r0	1
alpine/k8s :1.22.6	00ac10bcb759	curl@7.80.0-r0	8.0.1-r0	1
alpine/k8s :1.18.16	a41efe02a041	curl@7.78.0-r0	8.0.1-r0	1
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	curl@7.61.1-25.el8_7.3	0:7.61.1-30.el8_8.2	1
anchore/anchore-engine :v0.10.0	bde9eedf639d	curl@7.61.1-18.el8	0:7.61.1-30.el8_8.2	1
anchore/anchore-engine :v0.7.1	ed9b3badd17c	curl@7.61.1-11.el8	0:7.61.1-30.el8_8.2	1
anonaddy/anonaddy :0.12.3	957a95565166	curl@7.83.1-r2	8.0.1-r0	1
apache/camel-k :1.10.4	3bb13d14f64a	curl@7.61.1-22.el8_6.4	0:7.61.1-30.el8_8.2	1
apache/iotdb :0.13.3-node	afa47bf1692a	curl@7.68.0-1ubuntu2.13	7.68.0-1ubuntu2.18	1
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	1
apachepulsar/pulsar :2.9.0	d056c89b7131	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	1
apachepulsar/pulsar :2.8.2	d538416d5afe	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	1