One of the prerequisites for this CVE (CVE-2023-38545) to be exploited is the use of SOCKS5 proxies in host resolver mode. This would only be applicable if users explicitly configure MATLAB to use a proxy with "socks5h://" scheme (through proxy environment variables, Preferences, or the HttpOptions API).
Additionally, we implemented the use of ‘libcurl’ 8.4.0 in R2023b Update 4 and would suggest an upgrade to at least R2023b Update 4 version for resolving this CVE (if you use “sock5h” in your workflows) with older ‘libcurl’ versions.
The ‘libcurl’ is linked to the OpenSSL shipping with MATLAB at build time, and we've updated from OpenSSL 2 to OpenSSL 3 in R2023b which is a non-backwards compatible change. ‘libcurl’ will look for symbols in the OpenSSL that don't exist in older MATLABs. Dropping in the R2023b OpenSSL version into older releases is not an option, as it will break all libraries that use it.
Only the officially shipped 3rd party libraries are tested with MATLAB, and linking to any other 3rd party libraries may have potential downsides since MATLAB has not been tested with any other versions of those libraries. This is especially true for curl, which has extensive build time configuration options that we make use of.
