CVE-2023-27538

Medium

Advisory

Published 20 Mar 2023In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.013; 68th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 510; of 17,781 indexed, latest versions
Container images: 408; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 510 of 17,781 indexed charts deploy, on 408 images.

Affected package	Affected versions	Fixed in	Images
curldeb	7.58.0-2ubuntu3.3, 7.58.0-2ubuntu3.5, 7.58.0-2ubuntu3.6, 7.58.0-2ubuntu3.8+29 more	7.58.0-2ubuntu3.24, 7.68.0-1ubuntu2.18, 7.81.0-1ubuntu1.10	246
curlapk	7.77.0-r1, 7.78.0-r0, 7.79.1-r0, 7.79.1-r1+19 more	7.88.1-r1, 8.0.1-r0	162

OSV records: ALPINE-CVE-2023-27538 UBUNTU-CVE-2023-27538
Also known as: USN-5964-1

Charts affected

510 by stars

Chart

Latest

Affected images

Radar Score

queryservice-uiwbstack

0.2.0

1 of 1 See more

queryservice-ui wbstack 0.2.0

1 of the 1 container images this version deploys carry CVE-2023-27538.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/queryservice-ui :1.4	bc79fbb50230	curl@7.80.0-r0	8.0.1-r0

Open the chart page →

1,996

uiwbstack

0.4.0

1 of 1 See more

ui wbstack 0.4.0

1 of the 1 container images this version deploys carry CVE-2023-27538.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/ui :3.94	b01f67faadf1	curl@7.80.0-r1	8.0.1-r0

Open the chart page →

1,523

wbaas-backupwbstack

0.1.0

1 of 1 See more

wbaas-backup wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2023-27538.

Container image	Digest	Package	Fixed in
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	curl@7.58.0-2ubuntu3.18	7.58.0-2ubuntu3.24

Open the chart page →

9,743

generic-webhookwebhooks

0.1.1

1 of 1 See more

generic-webhook webhooks 0.1.1

1 of the 1 container images this version deploys carry CVE-2023-27538.

Container image	Digest	Package	Fixed in
ghcr.io/thecatlady/webhook :2.8.0	f04718704dab	curl@7.87.0-r2	7.88.1-r1

Open the chart page →

2,030

webresourcecataloguswebresourcecatalogus

1.1.0

1 of 4 See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2023-27538.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	curl@7.80.0-r0	8.0.1-r0

Open the chart page →

7,552

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2023-27538.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	curl@7.58.0-2ubuntu3.9	7.58.0-2ubuntu3.24

Open the chart page →

10,843

frpcwenerme

1.0.1

1 of 1 See more

3,359

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2023-27538.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18

Open the chart page →

15,230

workadventureworkadventure

1.1.0

2 of 9 See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2023-27538.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-chat :v1.17.7	da12f37e6795	curl@7.80.0-r1	8.0.1-r0
thecodingmachine/workadventure-ejabberd :v1.17.7	01df99622ad3	curl@7.80.0-r5	8.0.1-r0

Open the chart page →

16,083

default-backendwyrihaximusnet

1.1.0

1 of 1 See more

default-backend wyrihaximusnet 1.1.0

1 of the 1 container images this version deploys carry CVE-2023-27538.

Container image	Digest	Package	Fixed in
ghcr.io/wyrihaximusnet/default-backend :random	b24e63efd841	curl@7.79.1-r0	8.0.1-r0

Open the chart page →

2,534

Container images carrying it

408 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	curl@7.81.0-1ubuntu1.3	7.81.0-1ubuntu1.10	2
ghcr.io/games-on-whales/retroarch :1.0.0	103fbcec2314	curl@7.68.0-1ubuntu2.6	7.68.0-1ubuntu2.18	2
ghcr.io/linuxserver/openvpn-as :version-2.8.6-916f8e7d-ubuntu18	4ee0764310e7	curl@7.58.0-2ubuntu3.10	7.58.0-2ubuntu3.24	2
ghcr.io/salaboy/fmtok8s-frontend :v0.1.1	03fd01b4f56e	curl@7.81.0-1ubuntu1.2	7.81.0-1ubuntu1.10	2
ghcr.io/thecatlady/webhook :2.8.0	f04718704dab	curl@7.87.0-r2	7.88.1-r1	2
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	curl@7.80.0-r1	8.0.1-r0	2
quay.io/iver-wharf/wharf-web :v1.6.2	dc5d1ed91c26	curl@7.80.0-r1	8.0.1-r0	2
adwerx/github-actions-runner :2.276.1-20.04-1	840d2b078682	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.18	1
ahmedinfraplus/simple-app :STAGING	c50e6e81a637	curl@7.83.1-r2	8.0.1-r0	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.18	1
akaunting/akaunting :3.1.21-fpm-alpine-nginx	e7d5c245b1a0	curl@7.80.0-r3	8.0.1-r0	1
allegroai/clearml-agent-k8s-base :1.24-21	772827a01bb5	curl@7.58.0-2ubuntu3.19	7.58.0-2ubuntu3.24	1
alpine/git :2.36.3	66b210a97bc0	curl@7.83.1-r4	8.0.1-r0	1
alpine/k8s :1.22.6	00ac10bcb759	curl@7.80.0-r0	8.0.1-r0	1
alpine/k8s :1.18.16	a41efe02a041	curl@7.78.0-r0	8.0.1-r0	1
anonaddy/anonaddy :0.12.3	957a95565166	curl@7.83.1-r2	8.0.1-r0	1
apache/iotdb :0.13.3-node	afa47bf1692a	curl@7.68.0-1ubuntu2.13	7.68.0-1ubuntu2.18	1
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	1
apachepulsar/pulsar :2.9.0	d056c89b7131	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	1
apachepulsar/pulsar :2.8.2	d538416d5afe	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	1
apache/skywalking-oap-server :9.2.0	133d35d2c263	curl@7.81.0-1ubuntu1.3	7.81.0-1ubuntu1.10	1
apache/skywalking-oap-server :8.9.1	b4ec8c18d079	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	1
apache/skywalking-ui :9.2.0	295f1dc87d98	curl@7.81.0-1ubuntu1.3	7.81.0-1ubuntu1.10	1
apache/skywalking-ui :8.9.1	80530f0308a5	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	1
aquasec/trivy :0.32.0	973d0df16189	curl@7.83.1-r3	8.0.1-r0	1
assistiot/fl_orchestrator :ui-latest	20338b353aaf	curl@7.83.1-r3	8.0.1-r0	1
assistiot/fl_orchestrator :dbmongo4-latest	d157fbe150e3	curl@7.68.0-1ubuntu2.12	7.68.0-1ubuntu2.18	1
assistiot/location_processing :latest	e9bae124095f	curl@7.81.0-1ubuntu1.6	7.81.0-1ubuntu1.10	1
assistiot/open_api_kong :1.0.0	3fe850384689	curl@7.83.1-r4	8.0.1-r0	1
assistiot/tacticle_dashboard :web-latest	25fc9f373524	curl@7.83.1-r3	8.0.1-r0	1
atlassian/confluence-server :7.10.0	3b9222ab32ef	curl@7.81.0-1ubuntu1.6	7.81.0-1ubuntu1.10	1
bbernhard/signal-cli-rest-api :0.57	549ad08d7e14	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.18	1
bicarus/wg-access-server :v0.8.2	06cab48e9334	curl@7.83.1-r3	8.0.1-r0	1
blockscout/blockscout :5.1.5	c365a8f2dc12	curl@7.83.1-r5	8.0.1-r0	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	curl@7.68.0-1ubuntu2.6	7.68.0-1ubuntu2.18	1
casbin/casdoor :v1.224.0	66f836ef778b	curl@7.87.0-r1	7.88.1-r1	1
chaosnative/cle-frontend :2.7.0	07b82a82a702	curl@7.80.0-r0	8.0.1-r0	1
charmcli/soft-serve :v0.4.0	39523c1a6ba8	curl@7.83.1-r2	8.0.1-r0	1
chetangautamm/repo :sipp.v3	e7f7049e1544	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.18	1
clastix/kubectl :v1.21	87fabaccb3a6	curl@7.80.0-r0	8.0.1-r0	1
clastix/kubectl :v1.22	d0376d87ac6b	curl@7.80.0-r0	8.0.1-r0	1
cloudve/ttyd :latest	d79c1c5881c0	curl@7.58.0-2ubuntu3.9	7.58.0-2ubuntu3.24	1
crazymax/rtorrent-rutorrent :3.10-0.9.8-0.13.8	fb307f5b87bf	curl@7.87.0-r0	7.88.1-r1	1
cribl/cribl :3.0.2	762747cb6796	curl@7.58.0-2ubuntu3.13	7.58.0-2ubuntu3.24	1
daskdev/dask-notebook :1.1.0	052630f5ca04	curl@7.58.0-2ubuntu3.5	7.58.0-2ubuntu3.24	1
dellcloud/category :distributed	02fc234353a9	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.18	1
dellcloud/pages :1.0	4d2eb25b9225	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.18	1
devopstales/trivy-operator :2.5	75136aa7a26e	curl@7.87.0-r1	7.88.1-r1	1
dgraziotin/nginx-webdav-nononsense :1.23.1	38f2de42bed0	curl@7.68.0-1ubuntu2.12	7.68.0-1ubuntu2.18	1
dipugodocker/pdf-editor :1.0-frontend	d431c37fe1cd	curl@7.80.0-r3	8.0.1-r0	1