Vulnerabilites related to curl - curl
cve-2024-6197
Vulnerability from cvelistv5
Published
2024-07-24 07:29
Modified
2025-02-13 17:54
Severity ?
EPSS score ?
Summary
libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.
References
Impacted products
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:curl:curl:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.8.0", status: "affected", version: "8.6.0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-6197", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-07-24T18:42:30.556099Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-07-24T18:44:18.885Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-11-29T12:04:44.300Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "json", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-6197.json", }, { name: "www", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-6197.html", }, { name: "issue", tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2559516", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/07/24/1", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/07/24/5", }, { url: "https://security.netapp.com/advisory/ntap-20241129-0008/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.8.0", status: "affected", version: "8.8.0", versionType: "semver", }, { lessThanOrEqual: "8.7.1", status: "affected", version: "8.7.1", versionType: "semver", }, { lessThanOrEqual: "8.7.0", status: "affected", version: "8.7.0", versionType: "semver", }, { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "z2_", }, { lang: "en", type: "remediation developer", value: "z2_", }, ], descriptions: [ { lang: "en", value: "libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-590 Free of Memory not on the Heap", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-24T21:06:02.872Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-6197.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-6197.html", }, { name: "issue", url: "https://hackerone.com/reports/2559516", }, { url: "http://www.openwall.com/lists/oss-security/2024/07/24/1", }, { url: "http://www.openwall.com/lists/oss-security/2024/07/24/5", }, ], title: "freeing stack buffer in utf8asn1str", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-6197", datePublished: "2024-07-24T07:29:50.003Z", dateReserved: "2024-06-20T07:20:43.202Z", dateUpdated: "2025-02-13T17:54:41.039Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-2629
Vulnerability from cvelistv5
Published
2018-07-27 19:00
Modified
2024-08-05 14:02
Severity ?
EPSS score ?
Summary
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/96382 | vdb-entry, x_refsource_BID | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2629 | x_refsource_CONFIRM | |
| http://www.securitytracker.com/id/1037871 | vdb-entry, x_refsource_SECTRACK | |
| https://www.tenable.com/security/tns-2017-09 | x_refsource_CONFIRM | |
| https://curl.haxx.se/docs/adv_20170222.html | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201703-04 | vendor-advisory, x_refsource_GENTOO |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T14:02:06.938Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "96382", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/96382", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2629", }, { name: "1037871", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://www.securitytracker.com/id/1037871", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://www.tenable.com/security/tns-2017-09", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://curl.haxx.se/docs/adv_20170222.html", }, { name: "GLSA-201703-04", tags: [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred", ], url: "https://security.gentoo.org/glsa/201703-04", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "curl", vendor: "CURL", versions: [ { status: "affected", version: "7.53.0", }, ], }, ], datePublic: "2017-02-22T00:00:00", descriptions: [ { lang: "en", value: "curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).", }, ], metrics: [ { cvssV3_0: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", version: "3.0", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-295", description: "CWE-295", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2018-07-28T09:57:01", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { name: "96382", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/96382", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2629", }, { name: "1037871", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://www.securitytracker.com/id/1037871", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://www.tenable.com/security/tns-2017-09", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://curl.haxx.se/docs/adv_20170222.html", }, { name: "GLSA-201703-04", tags: [ "vendor-advisory", "x_refsource_GENTOO", ], url: "https://security.gentoo.org/glsa/201703-04", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2017-2629", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "curl", version: { version_data: [ { version_value: "7.53.0", }, ], }, }, ], }, vendor_name: "CURL", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).", }, ], }, impact: { cvss: [ [ { vectorString: "4.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", version: "3.0", }, ], ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-295", }, ], }, ], }, references: { reference_data: [ { name: "96382", refsource: "BID", url: "http://www.securityfocus.com/bid/96382", }, { name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2629", refsource: "CONFIRM", url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2629", }, { name: "1037871", refsource: "SECTRACK", url: "http://www.securitytracker.com/id/1037871", }, { name: "https://www.tenable.com/security/tns-2017-09", refsource: "CONFIRM", url: "https://www.tenable.com/security/tns-2017-09", }, { name: "https://curl.haxx.se/docs/adv_20170222.html", refsource: "CONFIRM", url: "https://curl.haxx.se/docs/adv_20170222.html", }, { name: "GLSA-201703-04", refsource: "GENTOO", url: "https://security.gentoo.org/glsa/201703-04", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2017-2629", datePublished: "2018-07-27T19:00:00", dateReserved: "2016-12-01T00:00:00", dateUpdated: "2024-08-05T14:02:06.938Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-2466
Vulnerability from cvelistv5
Published
2024-03-27 07:58
Modified
2025-02-13 17:40
Severity ?
EPSS score ?
Summary
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-19T07:47:51.205Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "json", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-2466.json", }, { name: "www", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-2466.html", }, { name: "issue", tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2416725", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/03/27/4", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240503-0010/", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214119", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214118", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214120", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/20", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/18", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/19", }, { url: "https://www.vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:curl:libcurl:8.5.0:*:*:*:*:*:*:*", ], defaultStatus: "unaffected", product: "libcurl", vendor: "curl", versions: [ { lessThanOrEqual: "8.6.0", status: "affected", version: "8.5.0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-2466", options: [ { Exploitation: "poc", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-08-23T18:43:18.887717Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-297", description: "CWE-297 Improper Validation of Certificate with Host Mismatch", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-08-23T18:46:47.386Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, { lessThanOrEqual: "8.5.0", status: "affected", version: "8.5.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Frank Yueh", }, { lang: "en", type: "remediation developer", value: "Stefan Eissing", }, ], descriptions: [ { lang: "en", value: "libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).", }, ], problemTypes: [ { descriptions: [ { description: "CWE-297 Improper Validation of Certificate with Host Mismatch", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-29T22:06:23.736Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-2466.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-2466.html", }, { name: "issue", url: "https://hackerone.com/reports/2416725", }, { url: "http://www.openwall.com/lists/oss-security/2024/03/27/4", }, { url: "https://security.netapp.com/advisory/ntap-20240503-0010/", }, { url: "https://support.apple.com/kb/HT214119", }, { url: "https://support.apple.com/kb/HT214118", }, { url: "https://support.apple.com/kb/HT214120", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/20", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/18", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/19", }, ], title: "TLS certificate check bypass with mbedTLS", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-2466", datePublished: "2024-03-27T07:58:24.520Z", dateReserved: "2024-03-14T17:21:59.730Z", dateUpdated: "2025-02-13T17:40:16.744Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-6874
Vulnerability from cvelistv5
Published
2024-07-24 07:36
Modified
2025-02-13 17:58
Severity ?
EPSS score ?
Summary
libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the *macidn* IDN backend. The conversion function then fills up the
provided buffer exactly - but does not null terminate the string.
This flaw can lead to stack contents accidently getting returned as part of
the converted string.
References
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:curl:libcurl:8.8.0:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "libcurl", vendor: "curl", versions: [ { status: "affected", version: "8.8.0", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.1, baseSeverity: "LOW", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-6874", options: [ { Exploitation: "poc", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-07-24T16:13:40.560966Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-07-24T16:25:51.575Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-22T18:03:17.766Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "json", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-6874.json", }, { name: "www", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-6874.html", }, { name: "issue", tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2604391", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/07/24/2", }, { url: "https://security.netapp.com/advisory/ntap-20240822-0004/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.8.0", status: "affected", version: "8.8.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "z2_", }, { lang: "en", type: "remediation developer", value: "z2_", }, ], descriptions: [ { lang: "en", value: "libcurl's URL API function\n[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode\nconversions, to and from IDN. Asking to convert a name that is exactly 256\nbytes, libcurl ends up reading outside of a stack based buffer when built to\nuse the *macidn* IDN backend. The conversion function then fills up the\nprovided buffer exactly - but does not null terminate the string.\n\nThis flaw can lead to stack contents accidently getting returned as part of\nthe converted string.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-126 Buffer Over-read", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-24T07:40:07.072Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-6874.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-6874.html", }, { name: "issue", url: "https://hackerone.com/reports/2604391", }, { url: "http://www.openwall.com/lists/oss-security/2024/07/24/2", }, ], title: "macidn punycode buffer overread", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-6874", datePublished: "2024-07-24T07:36:26.887Z", dateReserved: "2024-07-18T03:37:32.294Z", dateUpdated: "2025-02-13T17:58:00.151Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-46218
Vulnerability from cvelistv5
Published
2023-12-07 01:10
Modified
2025-02-13 17:14
Severity ?
EPSS score ?
Summary
This flaw allows a malicious HTTP server to set "super cookies" in curl that
are then passed back to more origins than what is otherwise allowed or
possible. This allows a site to set cookies that then would get sent to
different and unrelated sites and domains.
It could do this by exploiting a mixed case flaw in curl's function that
verifies a given cookie domain against the Public Suffix List (PSL). For
example a cookie could be set with `domain=co.UK` when the URL used a lower
case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T20:37:40.148Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2212193", }, { tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2023-46218.html", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/", }, { tags: [ "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html", }, { tags: [ "x_transferred", ], url: "https://www.debian.org/security/2023/dsa-5587", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240125-0007/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThan: "7.46.0", status: "unaffected", version: "7.46.0", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.", }, ], providerMetadata: { dateUpdated: "2024-01-25T14:06:39.330Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "https://hackerone.com/reports/2212193", }, { url: "https://curl.se/docs/CVE-2023-46218.html", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/", }, { url: "https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html", }, { url: "https://www.debian.org/security/2023/dsa-5587", }, { url: "https://security.netapp.com/advisory/ntap-20240125-0007/", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2023-46218", datePublished: "2023-12-07T01:10:34.846Z", dateReserved: "2023-10-19T01:00:12.854Z", dateUpdated: "2025-02-13T17:14:19.396Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-7264
Vulnerability from cvelistv5
Published
2024-07-31 08:08
Modified
2025-02-13 17:58
Severity ?
EPSS score ?
Summary
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an
ASN.1 Generalized Time field. If given an syntactically incorrect field, the
parser might end up using -1 for the length of the *time fraction*, leading to
a `strlen()` getting performed on a pointer to a heap buffer area that is not
(purposely) null terminated.
This flaw most likely leads to a crash, but can also lead to heap contents
getting returned to the application when
[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| curl | curl |
Version: 8.9.0 ≤ 8.9.0 Version: 8.8.0 ≤ 8.8.0 Version: 8.7.1 ≤ 8.7.1 Version: 8.7.0 ≤ 8.7.0 Version: 8.6.0 ≤ 8.6.0 Version: 8.5.0 ≤ 8.5.0 Version: 8.4.0 ≤ 8.4.0 Version: 8.3.0 ≤ 8.3.0 Version: 8.2.1 ≤ 8.2.1 Version: 8.2.0 ≤ 8.2.0 Version: 8.1.2 ≤ 8.1.2 Version: 8.1.1 ≤ 8.1.1 Version: 8.1.0 ≤ 8.1.0 Version: 8.0.1 ≤ 8.0.1 Version: 8.0.0 ≤ 8.0.0 Version: 7.88.1 ≤ 7.88.1 Version: 7.88.0 ≤ 7.88.0 Version: 7.87.0 ≤ 7.87.0 Version: 7.86.0 ≤ 7.86.0 Version: 7.85.0 ≤ 7.85.0 Version: 7.84.0 ≤ 7.84.0 Version: 7.83.1 ≤ 7.83.1 Version: 7.83.0 ≤ 7.83.0 Version: 7.82.0 ≤ 7.82.0 Version: 7.81.0 ≤ 7.81.0 Version: 7.80.0 ≤ 7.80.0 Version: 7.79.1 ≤ 7.79.1 Version: 7.79.0 ≤ 7.79.0 Version: 7.78.0 ≤ 7.78.0 Version: 7.77.0 ≤ 7.77.0 Version: 7.76.1 ≤ 7.76.1 Version: 7.76.0 ≤ 7.76.0 Version: 7.75.0 ≤ 7.75.0 Version: 7.74.0 ≤ 7.74.0 Version: 7.73.0 ≤ 7.73.0 Version: 7.72.0 ≤ 7.72.0 Version: 7.71.1 ≤ 7.71.1 Version: 7.71.0 ≤ 7.71.0 Version: 7.70.0 ≤ 7.70.0 Version: 7.69.1 ≤ 7.69.1 Version: 7.69.0 ≤ 7.69.0 Version: 7.68.0 ≤ 7.68.0 Version: 7.67.0 ≤ 7.67.0 Version: 7.66.0 ≤ 7.66.0 Version: 7.65.3 ≤ 7.65.3 Version: 7.65.2 ≤ 7.65.2 Version: 7.65.1 ≤ 7.65.1 Version: 7.65.0 ≤ 7.65.0 Version: 7.64.1 ≤ 7.64.1 Version: 7.64.0 ≤ 7.64.0 Version: 7.63.0 ≤ 7.63.0 Version: 7.62.0 ≤ 7.62.0 Version: 7.61.1 ≤ 7.61.1 Version: 7.61.0 ≤ 7.61.0 Version: 7.60.0 ≤ 7.60.0 Version: 7.59.0 ≤ 7.59.0 Version: 7.58.0 ≤ 7.58.0 Version: 7.57.0 ≤ 7.57.0 Version: 7.56.1 ≤ 7.56.1 Version: 7.56.0 ≤ 7.56.0 Version: 7.55.1 ≤ 7.55.1 Version: 7.55.0 ≤ 7.55.0 Version: 7.54.1 ≤ 7.54.1 Version: 7.54.0 ≤ 7.54.0 Version: 7.53.1 ≤ 7.53.1 Version: 7.53.0 ≤ 7.53.0 Version: 7.52.1 ≤ 7.52.1 Version: 7.52.0 ≤ 7.52.0 Version: 7.51.0 ≤ 7.51.0 Version: 7.50.3 ≤ 7.50.3 Version: 7.50.2 ≤ 7.50.2 Version: 7.50.1 ≤ 7.50.1 Version: 7.50.0 ≤ 7.50.0 Version: 7.49.1 ≤ 7.49.1 Version: 7.49.0 ≤ 7.49.0 Version: 7.48.0 ≤ 7.48.0 Version: 7.47.1 ≤ 7.47.1 Version: 7.47.0 ≤ 7.47.0 Version: 7.46.0 ≤ 7.46.0 Version: 7.45.0 ≤ 7.45.0 Version: 7.44.0 ≤ 7.44.0 Version: 7.43.0 ≤ 7.43.0 Version: 7.42.1 ≤ 7.42.1 Version: 7.42.0 ≤ 7.42.0 Version: 7.41.0 ≤ 7.41.0 Version: 7.40.0 ≤ 7.40.0 Version: 7.39.0 ≤ 7.39.0 Version: 7.38.0 ≤ 7.38.0 Version: 7.37.1 ≤ 7.37.1 Version: 7.37.0 ≤ 7.37.0 Version: 7.36.0 ≤ 7.36.0 Version: 7.35.0 ≤ 7.35.0 Version: 7.34.0 ≤ 7.34.0 Version: 7.33.0 ≤ 7.33.0 Version: 7.32.0 ≤ 7.32.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-28T15:02:52.325Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/07/31/1", }, { url: "https://security.netapp.com/advisory/ntap-20240828-0008/", }, ], title: "CVE Program Container", }, { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 6.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", version: "3.1", }, }, { other: { content: { id: "CVE-2024-7264", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-08-01T20:05:41.315706Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-30T19:41:40.489Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.9.0", status: "affected", version: "8.9.0", versionType: "semver", }, { lessThanOrEqual: "8.8.0", status: "affected", version: "8.8.0", versionType: "semver", }, { lessThanOrEqual: "8.7.1", status: "affected", version: "8.7.1", versionType: "semver", }, { lessThanOrEqual: "8.7.0", status: "affected", version: "8.7.0", versionType: "semver", }, { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, { lessThanOrEqual: "8.5.0", status: "affected", version: "8.5.0", versionType: "semver", }, { lessThanOrEqual: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThanOrEqual: "8.3.0", status: "affected", version: "8.3.0", versionType: "semver", }, { lessThanOrEqual: "8.2.1", status: "affected", version: "8.2.1", versionType: "semver", }, { lessThanOrEqual: "8.2.0", status: "affected", version: "8.2.0", versionType: "semver", }, { lessThanOrEqual: "8.1.2", status: "affected", version: "8.1.2", versionType: "semver", }, { lessThanOrEqual: "8.1.1", status: "affected", version: "8.1.1", versionType: "semver", }, { lessThanOrEqual: "8.1.0", status: "affected", version: "8.1.0", versionType: "semver", }, { lessThanOrEqual: "8.0.1", status: "affected", version: "8.0.1", versionType: "semver", }, { lessThanOrEqual: "8.0.0", status: "affected", version: "8.0.0", versionType: "semver", }, { lessThanOrEqual: "7.88.1", status: "affected", version: "7.88.1", versionType: "semver", }, { lessThanOrEqual: "7.88.0", status: "affected", version: "7.88.0", versionType: "semver", }, { lessThanOrEqual: "7.87.0", status: "affected", version: "7.87.0", versionType: "semver", }, { lessThanOrEqual: "7.86.0", status: "affected", version: "7.86.0", versionType: "semver", }, { lessThanOrEqual: "7.85.0", status: "affected", version: "7.85.0", versionType: "semver", }, { lessThanOrEqual: "7.84.0", status: "affected", version: "7.84.0", versionType: "semver", }, { lessThanOrEqual: "7.83.1", status: "affected", version: "7.83.1", versionType: "semver", }, { lessThanOrEqual: "7.83.0", status: "affected", version: "7.83.0", versionType: "semver", }, { lessThanOrEqual: "7.82.0", status: "affected", version: "7.82.0", versionType: "semver", }, { lessThanOrEqual: "7.81.0", status: "affected", version: "7.81.0", versionType: "semver", }, { lessThanOrEqual: "7.80.0", status: "affected", version: "7.80.0", versionType: "semver", }, { lessThanOrEqual: "7.79.1", status: "affected", version: "7.79.1", versionType: "semver", }, { lessThanOrEqual: "7.79.0", status: "affected", version: "7.79.0", versionType: "semver", }, { lessThanOrEqual: "7.78.0", status: "affected", version: "7.78.0", versionType: "semver", }, { lessThanOrEqual: "7.77.0", status: "affected", version: "7.77.0", versionType: "semver", }, { lessThanOrEqual: "7.76.1", status: "affected", version: "7.76.1", versionType: "semver", }, { lessThanOrEqual: "7.76.0", status: "affected", version: "7.76.0", versionType: "semver", }, { lessThanOrEqual: "7.75.0", status: "affected", version: "7.75.0", versionType: "semver", }, { lessThanOrEqual: "7.74.0", status: "affected", version: "7.74.0", versionType: "semver", }, { lessThanOrEqual: "7.73.0", status: "affected", version: "7.73.0", versionType: "semver", }, { lessThanOrEqual: "7.72.0", status: "affected", version: "7.72.0", versionType: "semver", }, { lessThanOrEqual: "7.71.1", status: "affected", version: "7.71.1", versionType: "semver", }, { lessThanOrEqual: "7.71.0", status: "affected", version: "7.71.0", versionType: "semver", }, { lessThanOrEqual: "7.70.0", status: "affected", version: "7.70.0", versionType: "semver", }, { lessThanOrEqual: "7.69.1", status: "affected", version: "7.69.1", versionType: "semver", }, { lessThanOrEqual: "7.69.0", status: "affected", version: "7.69.0", versionType: "semver", }, { lessThanOrEqual: "7.68.0", status: "affected", version: "7.68.0", versionType: "semver", }, { lessThanOrEqual: "7.67.0", status: "affected", version: "7.67.0", versionType: "semver", }, { lessThanOrEqual: "7.66.0", status: "affected", version: "7.66.0", versionType: "semver", }, { lessThanOrEqual: "7.65.3", status: "affected", version: "7.65.3", versionType: "semver", }, { lessThanOrEqual: "7.65.2", status: "affected", version: "7.65.2", versionType: "semver", }, { lessThanOrEqual: "7.65.1", status: "affected", version: "7.65.1", versionType: "semver", }, { lessThanOrEqual: "7.65.0", status: "affected", version: "7.65.0", versionType: "semver", }, { lessThanOrEqual: "7.64.1", status: "affected", version: "7.64.1", versionType: "semver", }, { lessThanOrEqual: "7.64.0", status: "affected", version: "7.64.0", versionType: "semver", }, { lessThanOrEqual: "7.63.0", status: "affected", version: "7.63.0", versionType: "semver", }, { lessThanOrEqual: "7.62.0", status: "affected", version: "7.62.0", versionType: "semver", }, { lessThanOrEqual: "7.61.1", status: "affected", version: "7.61.1", versionType: "semver", }, { lessThanOrEqual: "7.61.0", status: "affected", version: "7.61.0", versionType: "semver", }, { lessThanOrEqual: "7.60.0", status: "affected", version: "7.60.0", versionType: "semver", }, { lessThanOrEqual: "7.59.0", status: "affected", version: "7.59.0", versionType: "semver", }, { lessThanOrEqual: "7.58.0", status: "affected", version: "7.58.0", versionType: "semver", }, { lessThanOrEqual: "7.57.0", status: "affected", version: "7.57.0", versionType: "semver", }, { lessThanOrEqual: "7.56.1", status: "affected", version: "7.56.1", versionType: "semver", }, { lessThanOrEqual: "7.56.0", status: "affected", version: "7.56.0", versionType: "semver", }, { lessThanOrEqual: "7.55.1", status: "affected", version: "7.55.1", versionType: "semver", }, { lessThanOrEqual: "7.55.0", status: "affected", version: "7.55.0", versionType: "semver", }, { lessThanOrEqual: "7.54.1", status: "affected", version: "7.54.1", versionType: "semver", }, { lessThanOrEqual: "7.54.0", status: "affected", version: "7.54.0", versionType: "semver", }, { lessThanOrEqual: "7.53.1", status: "affected", version: "7.53.1", versionType: "semver", }, { lessThanOrEqual: "7.53.0", status: "affected", version: "7.53.0", versionType: "semver", }, { lessThanOrEqual: "7.52.1", status: "affected", version: "7.52.1", versionType: "semver", }, { lessThanOrEqual: "7.52.0", status: "affected", version: "7.52.0", versionType: "semver", }, { lessThanOrEqual: "7.51.0", status: "affected", version: "7.51.0", versionType: "semver", }, { lessThanOrEqual: "7.50.3", status: "affected", version: "7.50.3", versionType: "semver", }, { lessThanOrEqual: "7.50.2", status: "affected", version: "7.50.2", versionType: "semver", }, { lessThanOrEqual: "7.50.1", status: "affected", version: "7.50.1", versionType: "semver", }, { lessThanOrEqual: "7.50.0", status: "affected", version: "7.50.0", versionType: "semver", }, { lessThanOrEqual: "7.49.1", status: "affected", version: "7.49.1", versionType: "semver", }, { lessThanOrEqual: "7.49.0", status: "affected", version: "7.49.0", versionType: "semver", }, { lessThanOrEqual: "7.48.0", status: "affected", version: "7.48.0", versionType: "semver", }, { lessThanOrEqual: "7.47.1", status: "affected", version: "7.47.1", versionType: "semver", }, { lessThanOrEqual: "7.47.0", status: "affected", version: "7.47.0", versionType: "semver", }, { lessThanOrEqual: "7.46.0", status: "affected", version: "7.46.0", versionType: "semver", }, { lessThanOrEqual: "7.45.0", status: "affected", version: "7.45.0", versionType: "semver", }, { lessThanOrEqual: "7.44.0", status: "affected", version: "7.44.0", versionType: "semver", }, { lessThanOrEqual: "7.43.0", status: "affected", version: "7.43.0", versionType: "semver", }, { lessThanOrEqual: "7.42.1", status: "affected", version: "7.42.1", versionType: "semver", }, { lessThanOrEqual: "7.42.0", status: "affected", version: "7.42.0", versionType: "semver", }, { lessThanOrEqual: "7.41.0", status: "affected", version: "7.41.0", versionType: "semver", }, { lessThanOrEqual: "7.40.0", status: "affected", version: "7.40.0", versionType: "semver", }, { lessThanOrEqual: "7.39.0", status: "affected", version: "7.39.0", versionType: "semver", }, { lessThanOrEqual: "7.38.0", status: "affected", version: "7.38.0", versionType: "semver", }, { lessThanOrEqual: "7.37.1", status: "affected", version: "7.37.1", versionType: "semver", }, { lessThanOrEqual: "7.37.0", status: "affected", version: "7.37.0", versionType: "semver", }, { lessThanOrEqual: "7.36.0", status: "affected", version: "7.36.0", versionType: "semver", }, { lessThanOrEqual: "7.35.0", status: "affected", version: "7.35.0", versionType: "semver", }, { lessThanOrEqual: "7.34.0", status: "affected", version: "7.34.0", versionType: "semver", }, { lessThanOrEqual: "7.33.0", status: "affected", version: "7.33.0", versionType: "semver", }, { lessThanOrEqual: "7.32.0", status: "affected", version: "7.32.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Dov Murik (Transmit Security)", }, { lang: "en", type: "remediation developer", value: "Stefan Eissing", }, ], descriptions: [ { lang: "en", value: "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-125 Out-of-bounds Read", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-31T08:10:08.639Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-7264.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-7264.html", }, { name: "issue", url: "https://hackerone.com/reports/2629968", }, { url: "http://www.openwall.com/lists/oss-security/2024/07/31/1", }, ], title: "ASN.1 date parser overread", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-7264", datePublished: "2024-07-31T08:08:14.585Z", dateReserved: "2024-07-30T08:04:22.389Z", dateUpdated: "2025-02-13T17:58:03.375Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-46219
Vulnerability from cvelistv5
Published
2023-12-12 01:38
Modified
2025-02-13 17:14
Severity ?
EPSS score ?
Summary
When saving HSTS data to an excessively long file name, curl could end up
removing all contents, making subsequent requests using that file unaware of
the HSTS status they should otherwise use.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T20:37:40.116Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2236133", }, { tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2023-46219.html", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/", }, { tags: [ "x_transferred", ], url: "https://www.debian.org/security/2023/dsa-5587", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240119-0007/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThan: "7.84.0", status: "unaffected", version: "7.84.0", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "When saving HSTS data to an excessively long file name, curl could end up\nremoving all contents, making subsequent requests using that file unaware of\nthe HSTS status they should otherwise use.", }, ], providerMetadata: { dateUpdated: "2024-01-19T16:06:29.344Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "https://hackerone.com/reports/2236133", }, { url: "https://curl.se/docs/CVE-2023-46219.html", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/", }, { url: "https://www.debian.org/security/2023/dsa-5587", }, { url: "https://security.netapp.com/advisory/ntap-20240119-0007/", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2023-46219", datePublished: "2023-12-12T01:38:41.376Z", dateReserved: "2023-10-19T01:00:12.854Z", dateUpdated: "2025-02-13T17:14:19.963Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-0665
Vulnerability from cvelistv5
Published
2025-02-05 09:16
Modified
2025-03-18 18:10
Severity ?
EPSS score ?
Summary
libcurl would wrongly close the same eventfd file descriptor twice when taking
down a connection channel after having completed a threaded name resolve.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2025-03-07T00:10:49.291Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "http://www.openwall.com/lists/oss-security/2025/02/05/2", }, { url: "http://www.openwall.com/lists/oss-security/2025/02/05/5", }, { url: "https://security.netapp.com/advisory/ntap-20250306-0007/", }, ], title: "CVE Program Container", }, { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2025-0665", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2025-02-05T14:23:58.190612Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-1341", description: "CWE-1341 Multiple Releases of Same Resource or Handle", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-03-18T18:10:27.907Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.11.1", status: "affected", version: "8.11.1", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Christian Heusel", }, { lang: "en", type: "remediation developer", value: "Andy Pan", }, ], descriptions: [ { lang: "en", value: "libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-1341 Multiple Releases of Same Resource or Handle", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-05T09:16:49.038Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2025-0665.json", }, { name: "www", url: "https://curl.se/docs/CVE-2025-0665.html", }, { name: "issue", url: "https://hackerone.com/reports/2954286", }, ], title: "eventfd double close", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2025-0665", datePublished: "2025-02-05T09:16:49.038Z", dateReserved: "2025-01-23T08:40:34.867Z", dateUpdated: "2025-03-18T18:10:27.907Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-9681
Vulnerability from cvelistv5
Published
2024-11-06 07:47
Modified
2024-12-13 13:09
Severity ?
EPSS score ?
Summary
When curl is asked to use HSTS, the expiry time for a subdomain might
overwrite a parent domain's cache entry, making it end sooner or later than
otherwise intended.
This affects curl using applications that enable HSTS and use URLs with the
insecure `HTTP://` scheme and perform transfers with hosts like
`x.example.com` as well as `example.com` where the first host is a subdomain
of the second host.
(The HSTS cache either needs to have been populated manually or there needs to
have been previous HTTPS accesses done as the cache needs to have entries for
the domains involved to trigger this problem.)
When `x.example.com` responds with `Strict-Transport-Security:` headers, this
bug can make the subdomain's expiry timeout *bleed over* and get set for the
parent domain `example.com` in curl's HSTS cache.
The result of a triggered bug is that HTTP accesses to `example.com` get
converted to HTTPS for a different period of time than what was asked for by
the origin server. If `example.com` for example stops supporting HTTPS at its
expiry time, curl might then fail to access `http://example.com` until the
(wrongly set) timeout expires. This bug can also expire the parent's entry
*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier
than otherwise intended.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| curl | curl |
Version: 8.10.1 ≤ 8.10.1 Version: 8.10.0 ≤ 8.10.0 Version: 8.9.1 ≤ 8.9.1 Version: 8.9.0 ≤ 8.9.0 Version: 8.8.0 ≤ 8.8.0 Version: 8.7.1 ≤ 8.7.1 Version: 8.7.0 ≤ 8.7.0 Version: 8.6.0 ≤ 8.6.0 Version: 8.5.0 ≤ 8.5.0 Version: 8.4.0 ≤ 8.4.0 Version: 8.3.0 ≤ 8.3.0 Version: 8.2.1 ≤ 8.2.1 Version: 8.2.0 ≤ 8.2.0 Version: 8.1.2 ≤ 8.1.2 Version: 8.1.1 ≤ 8.1.1 Version: 8.1.0 ≤ 8.1.0 Version: 8.0.1 ≤ 8.0.1 Version: 8.0.0 ≤ 8.0.0 Version: 7.88.1 ≤ 7.88.1 Version: 7.88.0 ≤ 7.88.0 Version: 7.87.0 ≤ 7.87.0 Version: 7.86.0 ≤ 7.86.0 Version: 7.85.0 ≤ 7.85.0 Version: 7.84.0 ≤ 7.84.0 Version: 7.83.1 ≤ 7.83.1 Version: 7.83.0 ≤ 7.83.0 Version: 7.82.0 ≤ 7.82.0 Version: 7.81.0 ≤ 7.81.0 Version: 7.80.0 ≤ 7.80.0 Version: 7.79.1 ≤ 7.79.1 Version: 7.79.0 ≤ 7.79.0 Version: 7.78.0 ≤ 7.78.0 Version: 7.77.0 ≤ 7.77.0 Version: 7.76.1 ≤ 7.76.1 Version: 7.76.0 ≤ 7.76.0 Version: 7.75.0 ≤ 7.75.0 Version: 7.74.0 ≤ 7.74.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-12-13T13:09:28.285Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "http://www.openwall.com/lists/oss-security/2024/11/06/2", }, { url: "https://security.netapp.com/advisory/ntap-20241213-0006/", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:curl:curl:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "curl", vendor: "curl", versions: [ { lessThan: "7.74.0", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "8.10.1", status: "affected", version: "7.74.0", versionType: "semver", }, { lessThan: "*", status: "unaffected", version: "8.11.0", versionType: "semver", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-9681", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-11-06T16:16:59.652768Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-11-06T17:09:00.777Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.10.1", status: "affected", version: "8.10.1", versionType: "semver", }, { lessThanOrEqual: "8.10.0", status: "affected", version: "8.10.0", versionType: "semver", }, { lessThanOrEqual: "8.9.1", status: "affected", version: "8.9.1", versionType: "semver", }, { lessThanOrEqual: "8.9.0", status: "affected", version: "8.9.0", versionType: "semver", }, { lessThanOrEqual: "8.8.0", status: "affected", version: "8.8.0", versionType: "semver", }, { lessThanOrEqual: "8.7.1", status: "affected", version: "8.7.1", versionType: "semver", }, { lessThanOrEqual: "8.7.0", status: "affected", version: "8.7.0", versionType: "semver", }, { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, { lessThanOrEqual: "8.5.0", status: "affected", version: "8.5.0", versionType: "semver", }, { lessThanOrEqual: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThanOrEqual: "8.3.0", status: "affected", version: "8.3.0", versionType: "semver", }, { lessThanOrEqual: "8.2.1", status: "affected", version: "8.2.1", versionType: "semver", }, { lessThanOrEqual: "8.2.0", status: "affected", version: "8.2.0", versionType: "semver", }, { lessThanOrEqual: "8.1.2", status: "affected", version: "8.1.2", versionType: "semver", }, { lessThanOrEqual: "8.1.1", status: "affected", version: "8.1.1", versionType: "semver", }, { lessThanOrEqual: "8.1.0", status: "affected", version: "8.1.0", versionType: "semver", }, { lessThanOrEqual: "8.0.1", status: "affected", version: "8.0.1", versionType: "semver", }, { lessThanOrEqual: "8.0.0", status: "affected", version: "8.0.0", versionType: "semver", }, { lessThanOrEqual: "7.88.1", status: "affected", version: "7.88.1", versionType: "semver", }, { lessThanOrEqual: "7.88.0", status: "affected", version: "7.88.0", versionType: "semver", }, { lessThanOrEqual: "7.87.0", status: "affected", version: "7.87.0", versionType: "semver", }, { lessThanOrEqual: "7.86.0", status: "affected", version: "7.86.0", versionType: "semver", }, { lessThanOrEqual: "7.85.0", status: "affected", version: "7.85.0", versionType: "semver", }, { lessThanOrEqual: "7.84.0", status: "affected", version: "7.84.0", versionType: "semver", }, { lessThanOrEqual: "7.83.1", status: "affected", version: "7.83.1", versionType: "semver", }, { lessThanOrEqual: "7.83.0", status: "affected", version: "7.83.0", versionType: "semver", }, { lessThanOrEqual: "7.82.0", status: "affected", version: "7.82.0", versionType: "semver", }, { lessThanOrEqual: "7.81.0", status: "affected", version: "7.81.0", versionType: "semver", }, { lessThanOrEqual: "7.80.0", status: "affected", version: "7.80.0", versionType: "semver", }, { lessThanOrEqual: "7.79.1", status: "affected", version: "7.79.1", versionType: "semver", }, { lessThanOrEqual: "7.79.0", status: "affected", version: "7.79.0", versionType: "semver", }, { lessThanOrEqual: "7.78.0", status: "affected", version: "7.78.0", versionType: "semver", }, { lessThanOrEqual: "7.77.0", status: "affected", version: "7.77.0", versionType: "semver", }, { lessThanOrEqual: "7.76.1", status: "affected", version: "7.76.1", versionType: "semver", }, { lessThanOrEqual: "7.76.0", status: "affected", version: "7.76.0", versionType: "semver", }, { lessThanOrEqual: "7.75.0", status: "affected", version: "7.75.0", versionType: "semver", }, { lessThanOrEqual: "7.74.0", status: "affected", version: "7.74.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "newfunction", }, { lang: "en", type: "remediation developer", value: "Daniel Stenberg", }, ], descriptions: [ { lang: "en", value: "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-1025 Comparison Using Wrong Factors", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-11-06T07:47:20.162Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-9681.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-9681.html", }, { name: "issue", url: "https://hackerone.com/reports/2764830", }, ], title: "HSTS subdomain overwrites parent cache entry", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-9681", datePublished: "2024-11-06T07:47:20.162Z", dateReserved: "2024-10-09T07:57:47.318Z", dateUpdated: "2024-12-13T13:09:28.285Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2019-5436
Vulnerability from cvelistv5
Published
2019-05-28 18:47
Modified
2024-08-04 19:54
Severity ?
EPSS score ?
Summary
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T19:54:53.472Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "openSUSE-SU-2019:1492", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html", }, { name: "openSUSE-SU-2019:1508", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html", }, { name: "FEDORA-2019-697de0501f", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/", }, { name: "[oss-security] 20190911 [SECURITY ADVISORY] curl: TFTP small blocksize heap buffer overflow", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2019/09/11/6", }, { name: "DSA-4633", tags: [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred", ], url: "https://www.debian.org/security/2020/dsa-4633", }, { name: "20200225 [SECURITY] [DSA 4633-1] curl security update", tags: [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred", ], url: "https://seclists.org/bugtraq/2020/Feb/36", }, { name: "GLSA-202003-29", tags: [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred", ], url: "https://security.gentoo.org/glsa/202003-29", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20190606-0004/", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://curl.haxx.se/docs/CVE-2019-5436.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://support.f5.com/csp/article/K55133295", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://support.f5.com/csp/article/K55133295?utm_source=f5support&%3Butm_medium=RSS", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "curl", vendor: "curl", versions: [ { status: "affected", version: "Fixed in 7.65.0", }, ], }, ], datePublic: "2019-05-22T00:00:00", descriptions: [ { lang: "en", value: "A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-122", description: "Heap Overflow (CWE-122)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2020-10-20T21:15:00", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { name: "openSUSE-SU-2019:1492", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html", }, { name: "openSUSE-SU-2019:1508", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html", }, { name: "FEDORA-2019-697de0501f", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/", }, { name: "[oss-security] 20190911 [SECURITY ADVISORY] curl: TFTP small blocksize heap buffer overflow", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://www.openwall.com/lists/oss-security/2019/09/11/6", }, { name: "DSA-4633", tags: [ "vendor-advisory", "x_refsource_DEBIAN", ], url: "https://www.debian.org/security/2020/dsa-4633", }, { name: "20200225 [SECURITY] [DSA 4633-1] curl security update", tags: [ "mailing-list", "x_refsource_BUGTRAQ", ], url: "https://seclists.org/bugtraq/2020/Feb/36", }, { name: "GLSA-202003-29", tags: [ "vendor-advisory", "x_refsource_GENTOO", ], url: "https://security.gentoo.org/glsa/202003-29", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://security.netapp.com/advisory/ntap-20190606-0004/", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://curl.haxx.se/docs/CVE-2019-5436.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://support.f5.com/csp/article/K55133295", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://support.f5.com/csp/article/K55133295?utm_source=f5support&%3Butm_medium=RSS", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "support@hackerone.com", ID: "CVE-2019-5436", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "curl", version: { version_data: [ { version_value: "Fixed in 7.65.0", }, ], }, }, ], }, vendor_name: "curl", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Heap Overflow (CWE-122)", }, ], }, ], }, references: { reference_data: [ { name: "openSUSE-SU-2019:1492", refsource: "SUSE", url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html", }, { name: "openSUSE-SU-2019:1508", refsource: "SUSE", url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html", }, { name: "FEDORA-2019-697de0501f", refsource: "FEDORA", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/", }, { name: "[oss-security] 20190911 [SECURITY ADVISORY] curl: TFTP small blocksize heap buffer overflow", refsource: "MLIST", url: "http://www.openwall.com/lists/oss-security/2019/09/11/6", }, { name: "DSA-4633", refsource: "DEBIAN", url: "https://www.debian.org/security/2020/dsa-4633", }, { name: "20200225 [SECURITY] [DSA 4633-1] curl security update", refsource: "BUGTRAQ", url: "https://seclists.org/bugtraq/2020/Feb/36", }, { name: "GLSA-202003-29", refsource: "GENTOO", url: "https://security.gentoo.org/glsa/202003-29", }, { name: "https://www.oracle.com/security-alerts/cpuapr2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { name: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", refsource: "MISC", url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { name: "https://www.oracle.com/security-alerts/cpuoct2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { name: "https://security.netapp.com/advisory/ntap-20190606-0004/", refsource: "CONFIRM", url: "https://security.netapp.com/advisory/ntap-20190606-0004/", }, { name: "https://curl.haxx.se/docs/CVE-2019-5436.html", refsource: "CONFIRM", url: "https://curl.haxx.se/docs/CVE-2019-5436.html", }, { name: "https://support.f5.com/csp/article/K55133295", refsource: "CONFIRM", url: "https://support.f5.com/csp/article/K55133295", }, { name: "https://support.f5.com/csp/article/K55133295?utm_source=f5support&utm_medium=RSS", refsource: "CONFIRM", url: "https://support.f5.com/csp/article/K55133295?utm_source=f5support&utm_medium=RSS", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2019-5436", datePublished: "2019-05-28T18:47:32", dateReserved: "2019-01-04T00:00:00", dateUpdated: "2024-08-04T19:54:53.472Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-2379
Vulnerability from cvelistv5
Published
2024-03-27 07:56
Modified
2025-02-13 17:39
Severity ?
EPSS score ?
Summary
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-01T19:11:53.464Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "json", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-2379.json", }, { name: "www", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-2379.html", }, { name: "issue", tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2410774", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/03/27/2", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240531-0001/", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214119", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214118", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214120", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/20", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/18", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/19", }, ], title: "CVE Program Container", }, { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 6.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.1", }, }, { other: { content: { id: "CVE-2024-2379", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-08-19T17:42:40.991655Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-11-14T19:51:37.916Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Dexter Gerig", }, { lang: "en", type: "remediation developer", value: "Daniel Stenberg", }, ], descriptions: [ { lang: "en", value: "libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-295 Improper Certificate Validation", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-29T22:06:15.682Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-2379.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-2379.html", }, { name: "issue", url: "https://hackerone.com/reports/2410774", }, { url: "http://www.openwall.com/lists/oss-security/2024/03/27/2", }, { url: "https://security.netapp.com/advisory/ntap-20240531-0001/", }, { url: "https://support.apple.com/kb/HT214119", }, { url: "https://support.apple.com/kb/HT214118", }, { url: "https://support.apple.com/kb/HT214120", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/20", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/18", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/19", }, ], title: "QUIC certificate check bypass with wolfSSL", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-2379", datePublished: "2024-03-27T07:56:41.158Z", dateReserved: "2024-03-11T14:39:01.543Z", dateUpdated: "2025-02-13T17:39:51.599Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-0725
Vulnerability from cvelistv5
Published
2025-02-05 09:18
Modified
2025-03-07 00:10
Severity ?
EPSS score ?
Summary
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| curl | curl |
Version: 8.11.1 ≤ 8.11.1 Version: 8.11.0 ≤ 8.11.0 Version: 8.10.1 ≤ 8.10.1 Version: 8.10.0 ≤ 8.10.0 Version: 8.9.1 ≤ 8.9.1 Version: 8.9.0 ≤ 8.9.0 Version: 8.8.0 ≤ 8.8.0 Version: 8.7.1 ≤ 8.7.1 Version: 8.7.0 ≤ 8.7.0 Version: 8.6.0 ≤ 8.6.0 Version: 8.5.0 ≤ 8.5.0 Version: 8.4.0 ≤ 8.4.0 Version: 8.3.0 ≤ 8.3.0 Version: 8.2.1 ≤ 8.2.1 Version: 8.2.0 ≤ 8.2.0 Version: 8.1.2 ≤ 8.1.2 Version: 8.1.1 ≤ 8.1.1 Version: 8.1.0 ≤ 8.1.0 Version: 8.0.1 ≤ 8.0.1 Version: 8.0.0 ≤ 8.0.0 Version: 7.88.1 ≤ 7.88.1 Version: 7.88.0 ≤ 7.88.0 Version: 7.87.0 ≤ 7.87.0 Version: 7.86.0 ≤ 7.86.0 Version: 7.85.0 ≤ 7.85.0 Version: 7.84.0 ≤ 7.84.0 Version: 7.83.1 ≤ 7.83.1 Version: 7.83.0 ≤ 7.83.0 Version: 7.82.0 ≤ 7.82.0 Version: 7.81.0 ≤ 7.81.0 Version: 7.80.0 ≤ 7.80.0 Version: 7.79.1 ≤ 7.79.1 Version: 7.79.0 ≤ 7.79.0 Version: 7.78.0 ≤ 7.78.0 Version: 7.77.0 ≤ 7.77.0 Version: 7.76.1 ≤ 7.76.1 Version: 7.76.0 ≤ 7.76.0 Version: 7.75.0 ≤ 7.75.0 Version: 7.74.0 ≤ 7.74.0 Version: 7.73.0 ≤ 7.73.0 Version: 7.72.0 ≤ 7.72.0 Version: 7.71.1 ≤ 7.71.1 Version: 7.71.0 ≤ 7.71.0 Version: 7.70.0 ≤ 7.70.0 Version: 7.69.1 ≤ 7.69.1 Version: 7.69.0 ≤ 7.69.0 Version: 7.68.0 ≤ 7.68.0 Version: 7.67.0 ≤ 7.67.0 Version: 7.66.0 ≤ 7.66.0 Version: 7.65.3 ≤ 7.65.3 Version: 7.65.2 ≤ 7.65.2 Version: 7.65.1 ≤ 7.65.1 Version: 7.65.0 ≤ 7.65.0 Version: 7.64.1 ≤ 7.64.1 Version: 7.64.0 ≤ 7.64.0 Version: 7.63.0 ≤ 7.63.0 Version: 7.62.0 ≤ 7.62.0 Version: 7.61.1 ≤ 7.61.1 Version: 7.61.0 ≤ 7.61.0 Version: 7.60.0 ≤ 7.60.0 Version: 7.59.0 ≤ 7.59.0 Version: 7.58.0 ≤ 7.58.0 Version: 7.57.0 ≤ 7.57.0 Version: 7.56.1 ≤ 7.56.1 Version: 7.56.0 ≤ 7.56.0 Version: 7.55.1 ≤ 7.55.1 Version: 7.55.0 ≤ 7.55.0 Version: 7.54.1 ≤ 7.54.1 Version: 7.54.0 ≤ 7.54.0 Version: 7.53.1 ≤ 7.53.1 Version: 7.53.0 ≤ 7.53.0 Version: 7.52.1 ≤ 7.52.1 Version: 7.52.0 ≤ 7.52.0 Version: 7.51.0 ≤ 7.51.0 Version: 7.50.3 ≤ 7.50.3 Version: 7.50.2 ≤ 7.50.2 Version: 7.50.1 ≤ 7.50.1 Version: 7.50.0 ≤ 7.50.0 Version: 7.49.1 ≤ 7.49.1 Version: 7.49.0 ≤ 7.49.0 Version: 7.48.0 ≤ 7.48.0 Version: 7.47.1 ≤ 7.47.1 Version: 7.47.0 ≤ 7.47.0 Version: 7.46.0 ≤ 7.46.0 Version: 7.45.0 ≤ 7.45.0 Version: 7.44.0 ≤ 7.44.0 Version: 7.43.0 ≤ 7.43.0 Version: 7.42.1 ≤ 7.42.1 Version: 7.42.0 ≤ 7.42.0 Version: 7.41.0 ≤ 7.41.0 Version: 7.40.0 ≤ 7.40.0 Version: 7.39.0 ≤ 7.39.0 Version: 7.38.0 ≤ 7.38.0 Version: 7.37.1 ≤ 7.37.1 Version: 7.37.0 ≤ 7.37.0 Version: 7.36.0 ≤ 7.36.0 Version: 7.35.0 ≤ 7.35.0 Version: 7.34.0 ≤ 7.34.0 Version: 7.33.0 ≤ 7.33.0 Version: 7.32.0 ≤ 7.32.0 Version: 7.31.0 ≤ 7.31.0 Version: 7.30.0 ≤ 7.30.0 Version: 7.29.0 ≤ 7.29.0 Version: 7.28.1 ≤ 7.28.1 Version: 7.28.0 ≤ 7.28.0 Version: 7.27.0 ≤ 7.27.0 Version: 7.26.0 ≤ 7.26.0 Version: 7.25.0 ≤ 7.25.0 Version: 7.24.0 ≤ 7.24.0 Version: 7.23.1 ≤ 7.23.1 Version: 7.23.0 ≤ 7.23.0 Version: 7.22.0 ≤ 7.22.0 Version: 7.21.7 ≤ 7.21.7 Version: 7.21.6 ≤ 7.21.6 Version: 7.21.5 ≤ 7.21.5 Version: 7.21.4 ≤ 7.21.4 Version: 7.21.3 ≤ 7.21.3 Version: 7.21.2 ≤ 7.21.2 Version: 7.21.1 ≤ 7.21.1 Version: 7.21.0 ≤ 7.21.0 Version: 7.20.1 ≤ 7.20.1 Version: 7.20.0 ≤ 7.20.0 Version: 7.19.7 ≤ 7.19.7 Version: 7.19.6 ≤ 7.19.6 Version: 7.19.5 ≤ 7.19.5 Version: 7.19.4 ≤ 7.19.4 Version: 7.19.3 ≤ 7.19.3 Version: 7.19.2 ≤ 7.19.2 Version: 7.19.1 ≤ 7.19.1 Version: 7.19.0 ≤ 7.19.0 Version: 7.18.2 ≤ 7.18.2 Version: 7.18.1 ≤ 7.18.1 Version: 7.18.0 ≤ 7.18.0 Version: 7.17.1 ≤ 7.17.1 Version: 7.17.0 ≤ 7.17.0 Version: 7.16.4 ≤ 7.16.4 Version: 7.16.3 ≤ 7.16.3 Version: 7.16.2 ≤ 7.16.2 Version: 7.16.1 ≤ 7.16.1 Version: 7.16.0 ≤ 7.16.0 Version: 7.15.5 ≤ 7.15.5 Version: 7.15.4 ≤ 7.15.4 Version: 7.15.3 ≤ 7.15.3 Version: 7.15.2 ≤ 7.15.2 Version: 7.15.1 ≤ 7.15.1 Version: 7.15.0 ≤ 7.15.0 Version: 7.14.1 ≤ 7.14.1 Version: 7.14.0 ≤ 7.14.0 Version: 7.13.2 ≤ 7.13.2 Version: 7.13.1 ≤ 7.13.1 Version: 7.13.0 ≤ 7.13.0 Version: 7.12.3 ≤ 7.12.3 Version: 7.12.2 ≤ 7.12.2 Version: 7.12.1 ≤ 7.12.1 Version: 7.12.0 ≤ 7.12.0 Version: 7.11.2 ≤ 7.11.2 Version: 7.11.1 ≤ 7.11.1 Version: 7.11.0 ≤ 7.11.0 Version: 7.10.8 ≤ 7.10.8 Version: 7.10.7 ≤ 7.10.7 Version: 7.10.6 ≤ 7.10.6 Version: 7.10.5 ≤ 7.10.5 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2025-03-07T00:10:50.268Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "http://www.openwall.com/lists/oss-security/2025/02/05/3", }, { url: "http://www.openwall.com/lists/oss-security/2025/02/06/2", }, { url: "http://www.openwall.com/lists/oss-security/2025/02/06/4", }, { url: "https://security.netapp.com/advisory/ntap-20250306-0009/", }, ], title: "CVE Program Container", }, { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 7.3, baseSeverity: "HIGH", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", version: "3.1", }, }, { other: { content: { id: "CVE-2025-0725", options: [ { Exploitation: "poc", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-02-05T14:33:50.737849Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2025-02-05T14:34:15.390Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.11.1", status: "affected", version: "8.11.1", versionType: "semver", }, { lessThanOrEqual: "8.11.0", status: "affected", version: "8.11.0", versionType: "semver", }, { lessThanOrEqual: "8.10.1", status: "affected", version: "8.10.1", versionType: "semver", }, { lessThanOrEqual: "8.10.0", status: "affected", version: "8.10.0", versionType: "semver", }, { lessThanOrEqual: "8.9.1", status: "affected", version: "8.9.1", versionType: "semver", }, { lessThanOrEqual: "8.9.0", status: "affected", version: "8.9.0", versionType: "semver", }, { lessThanOrEqual: "8.8.0", status: "affected", version: "8.8.0", versionType: "semver", }, { lessThanOrEqual: "8.7.1", status: "affected", version: "8.7.1", versionType: "semver", }, { lessThanOrEqual: "8.7.0", status: "affected", version: "8.7.0", versionType: "semver", }, { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, { lessThanOrEqual: "8.5.0", status: "affected", version: "8.5.0", versionType: "semver", }, { lessThanOrEqual: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThanOrEqual: "8.3.0", status: "affected", version: "8.3.0", versionType: "semver", }, { lessThanOrEqual: "8.2.1", status: "affected", version: "8.2.1", versionType: "semver", }, { lessThanOrEqual: "8.2.0", status: "affected", version: "8.2.0", versionType: "semver", }, { lessThanOrEqual: "8.1.2", status: "affected", version: "8.1.2", versionType: "semver", }, { lessThanOrEqual: "8.1.1", status: "affected", version: "8.1.1", versionType: "semver", }, { lessThanOrEqual: "8.1.0", status: "affected", version: "8.1.0", versionType: "semver", }, { lessThanOrEqual: "8.0.1", status: "affected", version: "8.0.1", versionType: "semver", }, { lessThanOrEqual: "8.0.0", status: "affected", version: "8.0.0", versionType: "semver", }, { lessThanOrEqual: "7.88.1", status: "affected", version: "7.88.1", versionType: "semver", }, { lessThanOrEqual: "7.88.0", status: "affected", version: "7.88.0", versionType: "semver", }, { lessThanOrEqual: "7.87.0", status: "affected", version: "7.87.0", versionType: "semver", }, { lessThanOrEqual: "7.86.0", status: "affected", version: "7.86.0", versionType: "semver", }, { lessThanOrEqual: "7.85.0", status: "affected", version: "7.85.0", versionType: "semver", }, { lessThanOrEqual: "7.84.0", status: "affected", version: "7.84.0", versionType: "semver", }, { lessThanOrEqual: "7.83.1", status: "affected", version: "7.83.1", versionType: "semver", }, { lessThanOrEqual: "7.83.0", status: "affected", version: "7.83.0", versionType: "semver", }, { lessThanOrEqual: "7.82.0", status: "affected", version: "7.82.0", versionType: "semver", }, { lessThanOrEqual: "7.81.0", status: "affected", version: "7.81.0", versionType: "semver", }, { lessThanOrEqual: "7.80.0", status: "affected", version: "7.80.0", versionType: "semver", }, { lessThanOrEqual: "7.79.1", status: "affected", version: "7.79.1", versionType: "semver", }, { lessThanOrEqual: "7.79.0", status: "affected", version: "7.79.0", versionType: "semver", }, { lessThanOrEqual: "7.78.0", status: "affected", version: "7.78.0", versionType: "semver", }, { lessThanOrEqual: "7.77.0", status: "affected", version: "7.77.0", versionType: "semver", }, { lessThanOrEqual: "7.76.1", status: "affected", version: "7.76.1", versionType: "semver", }, { lessThanOrEqual: "7.76.0", status: "affected", version: "7.76.0", versionType: "semver", }, { lessThanOrEqual: "7.75.0", status: "affected", version: "7.75.0", versionType: "semver", }, { lessThanOrEqual: "7.74.0", status: "affected", version: "7.74.0", versionType: "semver", }, { lessThanOrEqual: "7.73.0", status: "affected", version: "7.73.0", versionType: "semver", }, { lessThanOrEqual: "7.72.0", status: "affected", version: "7.72.0", versionType: "semver", }, { lessThanOrEqual: "7.71.1", status: "affected", version: "7.71.1", versionType: "semver", }, { lessThanOrEqual: "7.71.0", status: "affected", version: "7.71.0", versionType: "semver", }, { lessThanOrEqual: "7.70.0", status: "affected", version: "7.70.0", versionType: "semver", }, { lessThanOrEqual: "7.69.1", status: "affected", version: "7.69.1", versionType: "semver", }, { lessThanOrEqual: "7.69.0", status: "affected", version: "7.69.0", versionType: "semver", }, { lessThanOrEqual: "7.68.0", status: "affected", version: "7.68.0", versionType: "semver", }, { lessThanOrEqual: "7.67.0", status: "affected", version: "7.67.0", versionType: "semver", }, { lessThanOrEqual: "7.66.0", status: "affected", version: "7.66.0", versionType: "semver", }, { lessThanOrEqual: "7.65.3", status: "affected", version: "7.65.3", versionType: "semver", }, { lessThanOrEqual: "7.65.2", status: "affected", version: "7.65.2", versionType: "semver", }, { lessThanOrEqual: "7.65.1", status: "affected", version: "7.65.1", versionType: "semver", }, { lessThanOrEqual: "7.65.0", status: "affected", version: "7.65.0", versionType: "semver", }, { lessThanOrEqual: "7.64.1", status: "affected", version: "7.64.1", versionType: "semver", }, { lessThanOrEqual: "7.64.0", status: "affected", version: "7.64.0", versionType: "semver", }, { lessThanOrEqual: "7.63.0", status: "affected", version: "7.63.0", versionType: "semver", }, { lessThanOrEqual: "7.62.0", status: "affected", version: "7.62.0", versionType: "semver", }, { lessThanOrEqual: "7.61.1", status: "affected", version: "7.61.1", versionType: "semver", }, { lessThanOrEqual: "7.61.0", status: "affected", version: "7.61.0", versionType: "semver", }, { lessThanOrEqual: "7.60.0", status: "affected", version: "7.60.0", versionType: "semver", }, { lessThanOrEqual: "7.59.0", status: "affected", version: "7.59.0", versionType: "semver", }, { lessThanOrEqual: "7.58.0", status: "affected", version: "7.58.0", versionType: "semver", }, { lessThanOrEqual: "7.57.0", status: "affected", version: "7.57.0", versionType: "semver", }, { lessThanOrEqual: "7.56.1", status: "affected", version: "7.56.1", versionType: "semver", }, { lessThanOrEqual: "7.56.0", status: "affected", version: "7.56.0", versionType: "semver", }, { lessThanOrEqual: "7.55.1", status: "affected", version: "7.55.1", versionType: "semver", }, { lessThanOrEqual: "7.55.0", status: "affected", version: "7.55.0", versionType: "semver", }, { lessThanOrEqual: "7.54.1", status: "affected", version: "7.54.1", versionType: "semver", }, { lessThanOrEqual: "7.54.0", status: "affected", version: "7.54.0", versionType: "semver", }, { lessThanOrEqual: "7.53.1", status: "affected", version: "7.53.1", versionType: "semver", }, { lessThanOrEqual: "7.53.0", status: "affected", version: "7.53.0", versionType: "semver", }, { lessThanOrEqual: "7.52.1", status: "affected", version: "7.52.1", versionType: "semver", }, { lessThanOrEqual: "7.52.0", status: "affected", version: "7.52.0", versionType: "semver", }, { lessThanOrEqual: "7.51.0", status: "affected", version: "7.51.0", versionType: "semver", }, { lessThanOrEqual: "7.50.3", status: "affected", version: "7.50.3", versionType: "semver", }, { lessThanOrEqual: "7.50.2", status: "affected", version: "7.50.2", versionType: "semver", }, { lessThanOrEqual: "7.50.1", status: "affected", version: "7.50.1", versionType: "semver", }, { lessThanOrEqual: "7.50.0", status: "affected", version: "7.50.0", versionType: "semver", }, { lessThanOrEqual: "7.49.1", status: "affected", version: "7.49.1", versionType: "semver", }, { lessThanOrEqual: "7.49.0", status: "affected", version: "7.49.0", versionType: "semver", }, { lessThanOrEqual: "7.48.0", status: "affected", version: "7.48.0", versionType: "semver", }, { lessThanOrEqual: "7.47.1", status: "affected", version: "7.47.1", versionType: "semver", }, { lessThanOrEqual: "7.47.0", status: "affected", version: "7.47.0", versionType: "semver", }, { lessThanOrEqual: "7.46.0", status: "affected", version: "7.46.0", versionType: "semver", }, { lessThanOrEqual: "7.45.0", status: "affected", version: "7.45.0", versionType: "semver", }, { lessThanOrEqual: "7.44.0", status: "affected", version: "7.44.0", versionType: "semver", }, { lessThanOrEqual: "7.43.0", status: "affected", version: "7.43.0", versionType: "semver", }, { lessThanOrEqual: "7.42.1", status: "affected", version: "7.42.1", versionType: "semver", }, { lessThanOrEqual: "7.42.0", status: "affected", version: "7.42.0", versionType: "semver", }, { lessThanOrEqual: "7.41.0", status: "affected", version: "7.41.0", versionType: "semver", }, { lessThanOrEqual: "7.40.0", status: "affected", version: "7.40.0", versionType: "semver", }, { lessThanOrEqual: "7.39.0", status: "affected", version: "7.39.0", versionType: "semver", }, { lessThanOrEqual: "7.38.0", status: "affected", version: "7.38.0", versionType: "semver", }, { lessThanOrEqual: "7.37.1", status: "affected", version: "7.37.1", versionType: "semver", }, { lessThanOrEqual: "7.37.0", status: "affected", version: "7.37.0", versionType: "semver", }, { lessThanOrEqual: "7.36.0", status: "affected", version: "7.36.0", versionType: "semver", }, { lessThanOrEqual: "7.35.0", status: "affected", version: "7.35.0", versionType: "semver", }, { lessThanOrEqual: "7.34.0", status: "affected", version: "7.34.0", versionType: "semver", }, { lessThanOrEqual: "7.33.0", status: "affected", version: "7.33.0", versionType: "semver", }, { lessThanOrEqual: "7.32.0", status: "affected", version: "7.32.0", versionType: "semver", }, { lessThanOrEqual: "7.31.0", status: "affected", version: "7.31.0", versionType: "semver", }, { lessThanOrEqual: "7.30.0", status: "affected", version: "7.30.0", versionType: "semver", }, { lessThanOrEqual: "7.29.0", status: "affected", version: "7.29.0", versionType: "semver", }, { lessThanOrEqual: "7.28.1", status: "affected", version: "7.28.1", versionType: "semver", }, { lessThanOrEqual: "7.28.0", status: "affected", version: "7.28.0", versionType: "semver", }, { lessThanOrEqual: "7.27.0", status: "affected", version: "7.27.0", versionType: "semver", }, { lessThanOrEqual: "7.26.0", status: "affected", version: "7.26.0", versionType: "semver", }, { lessThanOrEqual: "7.25.0", status: "affected", version: "7.25.0", versionType: "semver", }, { lessThanOrEqual: "7.24.0", status: "affected", version: "7.24.0", versionType: "semver", }, { lessThanOrEqual: "7.23.1", status: "affected", version: "7.23.1", versionType: "semver", }, { lessThanOrEqual: "7.23.0", status: "affected", version: "7.23.0", versionType: "semver", }, { lessThanOrEqual: "7.22.0", status: "affected", version: "7.22.0", versionType: "semver", }, { lessThanOrEqual: "7.21.7", status: "affected", version: "7.21.7", versionType: "semver", }, { lessThanOrEqual: "7.21.6", status: "affected", version: "7.21.6", versionType: "semver", }, { lessThanOrEqual: "7.21.5", status: "affected", version: "7.21.5", versionType: "semver", }, { lessThanOrEqual: "7.21.4", status: "affected", version: "7.21.4", versionType: "semver", }, { lessThanOrEqual: "7.21.3", status: "affected", version: "7.21.3", versionType: "semver", }, { lessThanOrEqual: "7.21.2", status: "affected", version: "7.21.2", versionType: "semver", }, { lessThanOrEqual: "7.21.1", status: "affected", version: "7.21.1", versionType: "semver", }, { lessThanOrEqual: "7.21.0", status: "affected", version: "7.21.0", versionType: "semver", }, { lessThanOrEqual: "7.20.1", status: "affected", version: "7.20.1", versionType: "semver", }, { lessThanOrEqual: "7.20.0", status: "affected", version: "7.20.0", versionType: "semver", }, { lessThanOrEqual: "7.19.7", status: "affected", version: "7.19.7", versionType: "semver", }, { lessThanOrEqual: "7.19.6", status: "affected", version: "7.19.6", versionType: "semver", }, { lessThanOrEqual: "7.19.5", status: "affected", version: "7.19.5", versionType: "semver", }, { lessThanOrEqual: "7.19.4", status: "affected", version: "7.19.4", versionType: "semver", }, { lessThanOrEqual: "7.19.3", status: "affected", version: "7.19.3", versionType: "semver", }, { lessThanOrEqual: "7.19.2", status: "affected", version: "7.19.2", versionType: "semver", }, { lessThanOrEqual: "7.19.1", status: "affected", version: "7.19.1", versionType: "semver", }, { lessThanOrEqual: "7.19.0", status: "affected", version: "7.19.0", versionType: "semver", }, { lessThanOrEqual: "7.18.2", status: "affected", version: "7.18.2", versionType: "semver", }, { lessThanOrEqual: "7.18.1", status: "affected", version: "7.18.1", versionType: "semver", }, { lessThanOrEqual: "7.18.0", status: "affected", version: "7.18.0", versionType: "semver", }, { lessThanOrEqual: "7.17.1", status: "affected", version: "7.17.1", versionType: "semver", }, { lessThanOrEqual: "7.17.0", status: "affected", version: "7.17.0", versionType: "semver", }, { lessThanOrEqual: "7.16.4", status: "affected", version: "7.16.4", versionType: "semver", }, { lessThanOrEqual: "7.16.3", status: "affected", version: "7.16.3", versionType: "semver", }, { lessThanOrEqual: "7.16.2", status: "affected", version: "7.16.2", versionType: "semver", }, { lessThanOrEqual: "7.16.1", status: "affected", version: "7.16.1", versionType: "semver", }, { lessThanOrEqual: "7.16.0", status: "affected", version: "7.16.0", versionType: "semver", }, { lessThanOrEqual: "7.15.5", status: "affected", version: "7.15.5", versionType: "semver", }, { lessThanOrEqual: "7.15.4", status: "affected", version: "7.15.4", versionType: "semver", }, { lessThanOrEqual: "7.15.3", status: "affected", version: "7.15.3", versionType: "semver", }, { lessThanOrEqual: "7.15.2", status: "affected", version: "7.15.2", versionType: "semver", }, { lessThanOrEqual: "7.15.1", status: "affected", version: "7.15.1", versionType: "semver", }, { lessThanOrEqual: "7.15.0", status: "affected", version: "7.15.0", versionType: "semver", }, { lessThanOrEqual: "7.14.1", status: "affected", version: "7.14.1", versionType: "semver", }, { lessThanOrEqual: "7.14.0", status: "affected", version: "7.14.0", versionType: "semver", }, { lessThanOrEqual: "7.13.2", status: "affected", version: "7.13.2", versionType: "semver", }, { lessThanOrEqual: "7.13.1", status: "affected", version: "7.13.1", versionType: "semver", }, { lessThanOrEqual: "7.13.0", status: "affected", version: "7.13.0", versionType: "semver", }, { lessThanOrEqual: "7.12.3", status: "affected", version: "7.12.3", versionType: "semver", }, { lessThanOrEqual: "7.12.2", status: "affected", version: "7.12.2", versionType: "semver", }, { lessThanOrEqual: "7.12.1", status: "affected", version: "7.12.1", versionType: "semver", }, { lessThanOrEqual: "7.12.0", status: "affected", version: "7.12.0", versionType: "semver", }, { lessThanOrEqual: "7.11.2", status: "affected", version: "7.11.2", versionType: "semver", }, { lessThanOrEqual: "7.11.1", status: "affected", version: "7.11.1", versionType: "semver", }, { lessThanOrEqual: "7.11.0", status: "affected", version: "7.11.0", versionType: "semver", }, { lessThanOrEqual: "7.10.8", status: "affected", version: "7.10.8", versionType: "semver", }, { lessThanOrEqual: "7.10.7", status: "affected", version: "7.10.7", versionType: "semver", }, { lessThanOrEqual: "7.10.6", status: "affected", version: "7.10.6", versionType: "semver", }, { lessThanOrEqual: "7.10.5", status: "affected", version: "7.10.5", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "z2_", }, { lang: "en", type: "remediation developer", value: "Daniel Stenberg", }, ], descriptions: [ { lang: "en", value: "When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-680 Integer Overflow to Buffer Overflow", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-05T09:18:20.468Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2025-0725.json", }, { name: "www", url: "https://curl.se/docs/CVE-2025-0725.html", }, { name: "issue", url: "https://hackerone.com/reports/2956023", }, ], title: "gzip integer overflow", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2025-0725", datePublished: "2025-02-05T09:18:20.468Z", dateReserved: "2025-01-27T04:58:09.514Z", dateUpdated: "2025-03-07T00:10:50.268Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-38039
Vulnerability from cvelistv5
Published
2023-09-15 03:21
Modified
2025-02-13 17:01
Severity ?
EPSS score ?
Summary
When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API.
However, curl did not have a limit in how many or how large headers it would
accept in a response, allowing a malicious server to stream an endless series
of headers and eventually cause curl to run out of heap memory.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:30:12.356Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2072338", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/", }, { tags: [ "x_transferred", ], url: "https://security.gentoo.org/glsa/202310-12", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20231013-0005/", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2023/Oct/17", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214036", }, { tags: [ "x_transferred", ], url: "https://www.insyde.com/security-pledge/SA-2023064", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214063", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214057", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214058", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jan/34", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jan/37", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jan/38", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "curl", vendor: "curl", versions: [ { lessThan: "8.3.0", status: "affected", version: "8.3.0", versionType: "semver", }, { lessThan: "7.84.0", status: "unaffected", version: "7.84.0", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "When curl retrieves an HTTP response, it stores the incoming headers so that\nthey can be accessed later via the libcurl headers API.\n\nHowever, curl did not have a limit in how many or how large headers it would\naccept in a response, allowing a malicious server to stream an endless series\nof headers and eventually cause curl to run out of heap memory.", }, ], providerMetadata: { dateUpdated: "2024-01-26T17:07:31.459Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "https://hackerone.com/reports/2072338", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/", }, { url: "https://security.gentoo.org/glsa/202310-12", }, { url: "https://security.netapp.com/advisory/ntap-20231013-0005/", }, { url: "http://seclists.org/fulldisclosure/2023/Oct/17", }, { url: "https://support.apple.com/kb/HT214036", }, { url: "https://www.insyde.com/security-pledge/SA-2023064", }, { url: "https://support.apple.com/kb/HT214063", }, { url: "https://support.apple.com/kb/HT214057", }, { url: "https://support.apple.com/kb/HT214058", }, { url: "http://seclists.org/fulldisclosure/2024/Jan/34", }, { url: "http://seclists.org/fulldisclosure/2024/Jan/37", }, { url: "http://seclists.org/fulldisclosure/2024/Jan/38", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2023-38039", datePublished: "2023-09-15T03:21:54.348Z", dateReserved: "2023-07-12T01:00:11.881Z", dateUpdated: "2025-02-13T17:01:44.367Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-2398
Vulnerability from cvelistv5
Published
2024-03-27 07:55
Modified
2025-02-13 17:40
Severity ?
EPSS score ?
Summary
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| curl | curl |
Version: 8.6.0 ≤ 8.6.0 Version: 8.5.0 ≤ 8.5.0 Version: 8.4.0 ≤ 8.4.0 Version: 8.3.0 ≤ 8.3.0 Version: 8.2.1 ≤ 8.2.1 Version: 8.2.0 ≤ 8.2.0 Version: 8.1.2 ≤ 8.1.2 Version: 8.1.1 ≤ 8.1.1 Version: 8.1.0 ≤ 8.1.0 Version: 8.0.1 ≤ 8.0.1 Version: 8.0.0 ≤ 8.0.0 Version: 7.88.1 ≤ 7.88.1 Version: 7.88.0 ≤ 7.88.0 Version: 7.87.0 ≤ 7.87.0 Version: 7.86.0 ≤ 7.86.0 Version: 7.85.0 ≤ 7.85.0 Version: 7.84.0 ≤ 7.84.0 Version: 7.83.1 ≤ 7.83.1 Version: 7.83.0 ≤ 7.83.0 Version: 7.82.0 ≤ 7.82.0 Version: 7.81.0 ≤ 7.81.0 Version: 7.80.0 ≤ 7.80.0 Version: 7.79.1 ≤ 7.79.1 Version: 7.79.0 ≤ 7.79.0 Version: 7.78.0 ≤ 7.78.0 Version: 7.77.0 ≤ 7.77.0 Version: 7.76.1 ≤ 7.76.1 Version: 7.76.0 ≤ 7.76.0 Version: 7.75.0 ≤ 7.75.0 Version: 7.74.0 ≤ 7.74.0 Version: 7.73.0 ≤ 7.73.0 Version: 7.72.0 ≤ 7.72.0 Version: 7.71.1 ≤ 7.71.1 Version: 7.71.0 ≤ 7.71.0 Version: 7.70.0 ≤ 7.70.0 Version: 7.69.1 ≤ 7.69.1 Version: 7.69.0 ≤ 7.69.0 Version: 7.68.0 ≤ 7.68.0 Version: 7.67.0 ≤ 7.67.0 Version: 7.66.0 ≤ 7.66.0 Version: 7.65.3 ≤ 7.65.3 Version: 7.65.2 ≤ 7.65.2 Version: 7.65.1 ≤ 7.65.1 Version: 7.65.0 ≤ 7.65.0 Version: 7.64.1 ≤ 7.64.1 Version: 7.64.0 ≤ 7.64.0 Version: 7.63.0 ≤ 7.63.0 Version: 7.62.0 ≤ 7.62.0 Version: 7.61.1 ≤ 7.61.1 Version: 7.61.0 ≤ 7.61.0 Version: 7.60.0 ≤ 7.60.0 Version: 7.59.0 ≤ 7.59.0 Version: 7.58.0 ≤ 7.58.0 Version: 7.57.0 ≤ 7.57.0 Version: 7.56.1 ≤ 7.56.1 Version: 7.56.0 ≤ 7.56.0 Version: 7.55.1 ≤ 7.55.1 Version: 7.55.0 ≤ 7.55.0 Version: 7.54.1 ≤ 7.54.1 Version: 7.54.0 ≤ 7.54.0 Version: 7.53.1 ≤ 7.53.1 Version: 7.53.0 ≤ 7.53.0 Version: 7.52.1 ≤ 7.52.1 Version: 7.52.0 ≤ 7.52.0 Version: 7.51.0 ≤ 7.51.0 Version: 7.50.3 ≤ 7.50.3 Version: 7.50.2 ≤ 7.50.2 Version: 7.50.1 ≤ 7.50.1 Version: 7.50.0 ≤ 7.50.0 Version: 7.49.1 ≤ 7.49.1 Version: 7.49.0 ≤ 7.49.0 Version: 7.48.0 ≤ 7.48.0 Version: 7.47.1 ≤ 7.47.1 Version: 7.47.0 ≤ 7.47.0 Version: 7.46.0 ≤ 7.46.0 Version: 7.45.0 ≤ 7.45.0 Version: 7.44.0 ≤ 7.44.0 |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:curl:curl:7.4:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.6.0", status: "affected", version: "7.44.0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 8.6, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", version: "3.1", }, }, { other: { content: { id: "CVE-2024-2398", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-04-26T18:57:39.256472Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-04T17:30:40.286Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-01T19:11:53.566Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "json", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-2398.json", }, { name: "www", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-2398.html", }, { name: "issue", tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2402845", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/03/27/3", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240503-0009/", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214119", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214118", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214120", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/20", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/18", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/19", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, { lessThanOrEqual: "8.5.0", status: "affected", version: "8.5.0", versionType: "semver", }, { lessThanOrEqual: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThanOrEqual: "8.3.0", status: "affected", version: "8.3.0", versionType: "semver", }, { lessThanOrEqual: "8.2.1", status: "affected", version: "8.2.1", versionType: "semver", }, { lessThanOrEqual: "8.2.0", status: "affected", version: "8.2.0", versionType: "semver", }, { lessThanOrEqual: "8.1.2", status: "affected", version: "8.1.2", versionType: "semver", }, { lessThanOrEqual: "8.1.1", status: "affected", version: "8.1.1", versionType: "semver", }, { lessThanOrEqual: "8.1.0", status: "affected", version: "8.1.0", versionType: "semver", }, { lessThanOrEqual: "8.0.1", status: "affected", version: "8.0.1", versionType: "semver", }, { lessThanOrEqual: "8.0.0", status: "affected", version: "8.0.0", versionType: "semver", }, { lessThanOrEqual: "7.88.1", status: "affected", version: "7.88.1", versionType: "semver", }, { lessThanOrEqual: "7.88.0", status: "affected", version: "7.88.0", versionType: "semver", }, { lessThanOrEqual: "7.87.0", status: "affected", version: "7.87.0", versionType: "semver", }, { lessThanOrEqual: "7.86.0", status: "affected", version: "7.86.0", versionType: "semver", }, { lessThanOrEqual: "7.85.0", status: "affected", version: "7.85.0", versionType: "semver", }, { lessThanOrEqual: "7.84.0", status: "affected", version: "7.84.0", versionType: "semver", }, { lessThanOrEqual: "7.83.1", status: "affected", version: "7.83.1", versionType: "semver", }, { lessThanOrEqual: "7.83.0", status: "affected", version: "7.83.0", versionType: "semver", }, { lessThanOrEqual: "7.82.0", status: "affected", version: "7.82.0", versionType: "semver", }, { lessThanOrEqual: "7.81.0", status: "affected", version: "7.81.0", versionType: "semver", }, { lessThanOrEqual: "7.80.0", status: "affected", version: "7.80.0", versionType: "semver", }, { lessThanOrEqual: "7.79.1", status: "affected", version: "7.79.1", versionType: "semver", }, { lessThanOrEqual: "7.79.0", status: "affected", version: "7.79.0", versionType: "semver", }, { lessThanOrEqual: "7.78.0", status: "affected", version: "7.78.0", versionType: "semver", }, { lessThanOrEqual: "7.77.0", status: "affected", version: "7.77.0", versionType: "semver", }, { lessThanOrEqual: "7.76.1", status: "affected", version: "7.76.1", versionType: "semver", }, { lessThanOrEqual: "7.76.0", status: "affected", version: "7.76.0", versionType: "semver", }, { lessThanOrEqual: "7.75.0", status: "affected", version: "7.75.0", versionType: "semver", }, { lessThanOrEqual: "7.74.0", status: "affected", version: "7.74.0", versionType: "semver", }, { lessThanOrEqual: "7.73.0", status: "affected", version: "7.73.0", versionType: "semver", }, { lessThanOrEqual: "7.72.0", status: "affected", version: "7.72.0", versionType: "semver", }, { lessThanOrEqual: "7.71.1", status: "affected", version: "7.71.1", versionType: "semver", }, { lessThanOrEqual: "7.71.0", status: "affected", version: "7.71.0", versionType: "semver", }, { lessThanOrEqual: "7.70.0", status: "affected", version: "7.70.0", versionType: "semver", }, { lessThanOrEqual: "7.69.1", status: "affected", version: "7.69.1", versionType: "semver", }, { lessThanOrEqual: "7.69.0", status: "affected", version: "7.69.0", versionType: "semver", }, { lessThanOrEqual: "7.68.0", status: "affected", version: "7.68.0", versionType: "semver", }, { lessThanOrEqual: "7.67.0", status: "affected", version: "7.67.0", versionType: "semver", }, { lessThanOrEqual: "7.66.0", status: "affected", version: "7.66.0", versionType: "semver", }, { lessThanOrEqual: "7.65.3", status: "affected", version: "7.65.3", versionType: "semver", }, { lessThanOrEqual: "7.65.2", status: "affected", version: "7.65.2", versionType: "semver", }, { lessThanOrEqual: "7.65.1", status: "affected", version: "7.65.1", versionType: "semver", }, { lessThanOrEqual: "7.65.0", status: "affected", version: "7.65.0", versionType: "semver", }, { lessThanOrEqual: "7.64.1", status: "affected", version: "7.64.1", versionType: "semver", }, { lessThanOrEqual: "7.64.0", status: "affected", version: "7.64.0", versionType: "semver", }, { lessThanOrEqual: "7.63.0", status: "affected", version: "7.63.0", versionType: "semver", }, { lessThanOrEqual: "7.62.0", status: "affected", version: "7.62.0", versionType: "semver", }, { lessThanOrEqual: "7.61.1", status: "affected", version: "7.61.1", versionType: "semver", }, { lessThanOrEqual: "7.61.0", status: "affected", version: "7.61.0", versionType: "semver", }, { lessThanOrEqual: "7.60.0", status: "affected", version: "7.60.0", versionType: "semver", }, { lessThanOrEqual: "7.59.0", status: "affected", version: "7.59.0", versionType: "semver", }, { lessThanOrEqual: "7.58.0", status: "affected", version: "7.58.0", versionType: "semver", }, { lessThanOrEqual: "7.57.0", status: "affected", version: "7.57.0", versionType: "semver", }, { lessThanOrEqual: "7.56.1", status: "affected", version: "7.56.1", versionType: "semver", }, { lessThanOrEqual: "7.56.0", status: "affected", version: "7.56.0", versionType: "semver", }, { lessThanOrEqual: "7.55.1", status: "affected", version: "7.55.1", versionType: "semver", }, { lessThanOrEqual: "7.55.0", status: "affected", version: "7.55.0", versionType: "semver", }, { lessThanOrEqual: "7.54.1", status: "affected", version: "7.54.1", versionType: "semver", }, { lessThanOrEqual: "7.54.0", status: "affected", version: "7.54.0", versionType: "semver", }, { lessThanOrEqual: "7.53.1", status: "affected", version: "7.53.1", versionType: "semver", }, { lessThanOrEqual: "7.53.0", status: "affected", version: "7.53.0", versionType: "semver", }, { lessThanOrEqual: "7.52.1", status: "affected", version: "7.52.1", versionType: "semver", }, { lessThanOrEqual: "7.52.0", status: "affected", version: "7.52.0", versionType: "semver", }, { lessThanOrEqual: "7.51.0", status: "affected", version: "7.51.0", versionType: "semver", }, { lessThanOrEqual: "7.50.3", status: "affected", version: "7.50.3", versionType: "semver", }, { lessThanOrEqual: "7.50.2", status: "affected", version: "7.50.2", versionType: "semver", }, { lessThanOrEqual: "7.50.1", status: "affected", version: "7.50.1", versionType: "semver", }, { lessThanOrEqual: "7.50.0", status: "affected", version: "7.50.0", versionType: "semver", }, { lessThanOrEqual: "7.49.1", status: "affected", version: "7.49.1", versionType: "semver", }, { lessThanOrEqual: "7.49.0", status: "affected", version: "7.49.0", versionType: "semver", }, { lessThanOrEqual: "7.48.0", status: "affected", version: "7.48.0", versionType: "semver", }, { lessThanOrEqual: "7.47.1", status: "affected", version: "7.47.1", versionType: "semver", }, { lessThanOrEqual: "7.47.0", status: "affected", version: "7.47.0", versionType: "semver", }, { lessThanOrEqual: "7.46.0", status: "affected", version: "7.46.0", versionType: "semver", }, { lessThanOrEqual: "7.45.0", status: "affected", version: "7.45.0", versionType: "semver", }, { lessThanOrEqual: "7.44.0", status: "affected", version: "7.44.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "w0x42 on hackerone", }, { lang: "en", type: "remediation developer", value: "Stefan Eissing", }, ], descriptions: [ { lang: "en", value: "When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-772 Missing Release of Resource after Effective Lifetime", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-29T22:06:29.645Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-2398.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-2398.html", }, { name: "issue", url: "https://hackerone.com/reports/2402845", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/", }, { url: "http://www.openwall.com/lists/oss-security/2024/03/27/3", }, { url: "https://security.netapp.com/advisory/ntap-20240503-0009/", }, { url: "https://support.apple.com/kb/HT214119", }, { url: "https://support.apple.com/kb/HT214118", }, { url: "https://support.apple.com/kb/HT214120", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/20", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/18", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/19", }, ], title: "HTTP/2 push headers memory-leak", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-2398", datePublished: "2024-03-27T07:55:48.524Z", dateReserved: "2024-03-12T10:59:22.660Z", dateUpdated: "2025-02-13T17:40:07.893Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2005-3185
Vulnerability from cvelistv5
Published
2005-10-13 04:00
Modified
2024-08-07 23:01
Severity ?
EPSS score ?
Summary
Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T23:01:59.006Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "20051013 Multiple Vendor wget/curl NTLM Username Buffer Overflow Vulnerability", tags: [ "third-party-advisory", "x_refsource_IDEFENSE", "x_transferred", ], url: "http://www.idefense.com/application/poi/display?id=322&type=vulnerabilities", }, { name: "17247", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17247", }, { name: "FEDORA-2005-1000", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "http://www.redhat.com/archives/fedora-announce-list/2005-October/msg00055.html", }, { name: "RHSA-2005:812", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2005-812.html", }, { name: "1015057", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://securitytracker.com/id?1015057", }, { name: "17813", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17813", }, { name: "17485", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17485", }, { name: "ADV-2005-2659", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2005/2659", }, { name: "TSLSA-2005-0059", tags: [ "vendor-advisory", "x_refsource_TRUSTIX", "x_transferred", ], url: "http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html", }, { name: "DSA-919", tags: [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred", ], url: "http://www.debian.org/security/2005/dsa-919", }, { name: "wget-curl-ntlm-username-bo(22721)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/22721", }, { name: "ADV-2005-2088", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2005/2088", }, { name: "FEDORA-2005-1129", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00020.html", }, { name: "17297", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17297", }, { name: "82", tags: [ "third-party-advisory", "x_refsource_SREASON", "x_transferred", ], url: "http://securityreason.com/securityalert/82", }, { name: "17193", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17193", }, { name: "17403", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17403", }, { name: "USN-205-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred", ], url: "https://usn.ubuntu.com/205-1/", }, { name: "17208", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17208", }, { name: "SUSE-SA:2005:063", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://www.novell.com/linux/security/advisories/2005_63_wget_curl.html", }, { name: "oval:org.mitre.oval:def:9810", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9810", }, { name: "APPLE-SA-2005-11-29", tags: [ "vendor-advisory", "x_refsource_APPLE", "x_transferred", ], url: "http://docs.info.apple.com/article.html?artnum=302847", }, { name: "15102", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/15102", }, { name: "17203", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17203", }, { name: "17965", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17965", }, { name: "ADV-2005-2125", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2005/2125", }, { name: "MDKSA-2005:182", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", "x_transferred", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:182", }, { name: "17400", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17400", }, { name: "17192", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17192", }, { name: "15647", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/15647", }, { name: "GLSA-200510-19", tags: [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred", ], url: "http://www.gentoo.org/security/en/glsa/glsa-200510-19.xml", }, { name: "1015056", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://securitytracker.com/id?1015056", }, { name: "RHSA-2005:807", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2005-807.html", }, { name: "19193", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/19193", }, { name: "SCOSA-2006.10", tags: [ "vendor-advisory", "x_refsource_SCO", "x_transferred", ], url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.10/SCOSA-2006.10.txt", }, { name: "SSA:2005-310-01", tags: [ "vendor-advisory", "x_refsource_SLACKWARE", "x_transferred", ], url: "http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.519010", }, { name: "17320", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17320", }, { name: "20011", tags: [ "vdb-entry", "x_refsource_OSVDB", "x_transferred", ], url: "http://www.osvdb.org/20011", }, { name: "17228", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17228", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2005-10-13T00:00:00", descriptions: [ { lang: "en", value: "Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-10-03T20:57:01", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "20051013 Multiple Vendor wget/curl NTLM Username Buffer Overflow Vulnerability", tags: [ "third-party-advisory", "x_refsource_IDEFENSE", ], url: "http://www.idefense.com/application/poi/display?id=322&type=vulnerabilities", }, { name: "17247", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17247", }, { name: "FEDORA-2005-1000", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "http://www.redhat.com/archives/fedora-announce-list/2005-October/msg00055.html", }, { name: "RHSA-2005:812", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2005-812.html", }, { name: "1015057", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://securitytracker.com/id?1015057", }, { name: "17813", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17813", }, { name: "17485", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17485", }, { name: "ADV-2005-2659", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2005/2659", }, { name: "TSLSA-2005-0059", tags: [ "vendor-advisory", "x_refsource_TRUSTIX", ], url: "http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html", }, { name: "DSA-919", tags: [ "vendor-advisory", "x_refsource_DEBIAN", ], url: "http://www.debian.org/security/2005/dsa-919", }, { name: "wget-curl-ntlm-username-bo(22721)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/22721", }, { name: "ADV-2005-2088", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2005/2088", }, { name: "FEDORA-2005-1129", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00020.html", }, { name: "17297", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17297", }, { name: "82", tags: [ "third-party-advisory", "x_refsource_SREASON", ], url: "http://securityreason.com/securityalert/82", }, { name: "17193", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17193", }, { name: "17403", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17403", }, { name: "USN-205-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", ], url: "https://usn.ubuntu.com/205-1/", }, { name: "17208", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17208", }, { name: "SUSE-SA:2005:063", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://www.novell.com/linux/security/advisories/2005_63_wget_curl.html", }, { name: "oval:org.mitre.oval:def:9810", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9810", }, { name: "APPLE-SA-2005-11-29", tags: [ "vendor-advisory", "x_refsource_APPLE", ], url: "http://docs.info.apple.com/article.html?artnum=302847", }, { name: "15102", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/15102", }, { name: "17203", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17203", }, { name: "17965", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17965", }, { name: "ADV-2005-2125", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2005/2125", }, { name: "MDKSA-2005:182", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:182", }, { name: "17400", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17400", }, { name: "17192", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17192", }, { name: "15647", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/15647", }, { name: "GLSA-200510-19", tags: [ "vendor-advisory", "x_refsource_GENTOO", ], url: "http://www.gentoo.org/security/en/glsa/glsa-200510-19.xml", }, { name: "1015056", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://securitytracker.com/id?1015056", }, { name: "RHSA-2005:807", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2005-807.html", }, { name: "19193", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/19193", }, { name: "SCOSA-2006.10", tags: [ "vendor-advisory", "x_refsource_SCO", ], url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.10/SCOSA-2006.10.txt", }, { name: "SSA:2005-310-01", tags: [ "vendor-advisory", "x_refsource_SLACKWARE", ], url: "http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.519010", }, { name: "17320", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17320", }, { name: "20011", tags: [ "vdb-entry", "x_refsource_OSVDB", ], url: "http://www.osvdb.org/20011", }, { name: "17228", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17228", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2005-3185", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "20051013 Multiple Vendor wget/curl NTLM Username Buffer Overflow Vulnerability", refsource: "IDEFENSE", url: "http://www.idefense.com/application/poi/display?id=322&type=vulnerabilities", }, { name: "17247", refsource: "SECUNIA", url: "http://secunia.com/advisories/17247", }, { name: "FEDORA-2005-1000", refsource: "FEDORA", url: "http://www.redhat.com/archives/fedora-announce-list/2005-October/msg00055.html", }, { name: "RHSA-2005:812", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2005-812.html", }, { name: "1015057", refsource: "SECTRACK", url: "http://securitytracker.com/id?1015057", }, { name: "17813", refsource: "SECUNIA", url: "http://secunia.com/advisories/17813", }, { name: "17485", refsource: "SECUNIA", url: "http://secunia.com/advisories/17485", }, { name: "ADV-2005-2659", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2005/2659", }, { name: "TSLSA-2005-0059", refsource: "TRUSTIX", url: "http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html", }, { name: "DSA-919", refsource: "DEBIAN", url: "http://www.debian.org/security/2005/dsa-919", }, { name: "wget-curl-ntlm-username-bo(22721)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/22721", }, { name: "ADV-2005-2088", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2005/2088", }, { name: "FEDORA-2005-1129", refsource: "FEDORA", url: "http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00020.html", }, { name: "17297", refsource: "SECUNIA", url: "http://secunia.com/advisories/17297", }, { name: "82", refsource: "SREASON", url: "http://securityreason.com/securityalert/82", }, { name: "17193", refsource: "SECUNIA", url: "http://secunia.com/advisories/17193", }, { name: "17403", refsource: "SECUNIA", url: "http://secunia.com/advisories/17403", }, { name: "USN-205-1", refsource: "UBUNTU", url: "https://usn.ubuntu.com/205-1/", }, { name: "17208", refsource: "SECUNIA", url: "http://secunia.com/advisories/17208", }, { name: "SUSE-SA:2005:063", refsource: "SUSE", url: "http://www.novell.com/linux/security/advisories/2005_63_wget_curl.html", }, { name: "oval:org.mitre.oval:def:9810", refsource: "OVAL", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9810", }, { name: "APPLE-SA-2005-11-29", refsource: "APPLE", url: "http://docs.info.apple.com/article.html?artnum=302847", }, { name: "15102", refsource: "BID", url: "http://www.securityfocus.com/bid/15102", }, { name: "17203", refsource: "SECUNIA", url: "http://secunia.com/advisories/17203", }, { name: "17965", refsource: "SECUNIA", url: "http://secunia.com/advisories/17965", }, { name: "ADV-2005-2125", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2005/2125", }, { name: "MDKSA-2005:182", refsource: "MANDRIVA", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:182", }, { name: "17400", refsource: "SECUNIA", url: "http://secunia.com/advisories/17400", }, { name: "17192", refsource: "SECUNIA", url: "http://secunia.com/advisories/17192", }, { name: "15647", refsource: "BID", url: "http://www.securityfocus.com/bid/15647", }, { name: "GLSA-200510-19", refsource: "GENTOO", url: "http://www.gentoo.org/security/en/glsa/glsa-200510-19.xml", }, { name: "1015056", refsource: "SECTRACK", url: "http://securitytracker.com/id?1015056", }, { name: "RHSA-2005:807", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2005-807.html", }, { name: "19193", refsource: "SECUNIA", url: "http://secunia.com/advisories/19193", }, { name: "SCOSA-2006.10", refsource: "SCO", url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.10/SCOSA-2006.10.txt", }, { name: "SSA:2005-310-01", refsource: "SLACKWARE", url: "http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.519010", }, { name: "17320", refsource: "SECUNIA", url: "http://secunia.com/advisories/17320", }, { name: "20011", refsource: "OSVDB", url: "http://www.osvdb.org/20011", }, { name: "17228", refsource: "SECUNIA", url: "http://secunia.com/advisories/17228", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2005-3185", datePublished: "2005-10-13T04:00:00", dateReserved: "2005-10-12T00:00:00", dateUpdated: "2024-08-07T23:01:59.006Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2009-0037
Vulnerability from cvelistv5
Published
2009-03-05 02:00
Modified
2024-08-07 04:17
Severity ?
EPSS score ?
Summary
The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T04:17:10.543Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "USN-726-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred", ], url: "http://www.ubuntu.com/usn/USN-726-1", }, { name: "34259", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/34259", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://curl.haxx.se/lxr/source/CHANGES", }, { name: "35766", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/35766", }, { name: "34255", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/34255", }, { name: "RHSA-2009:0341", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2009-0341.html", }, { name: "DSA-1738", tags: [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred", ], url: "http://www.debian.org/security/2009/dsa-1738", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/", }, { name: "curl-location-security-bypass(49030)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/49030", }, { name: "ADV-2009-1865", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2009/1865", }, { name: "APPLE-SA-2010-03-29-1", tags: [ "vendor-advisory", "x_refsource_APPLE", "x_transferred", ], url: "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0042", }, { name: "SUSE-SR:2009:006", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html", }, { name: "34138", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/34138", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://curl.haxx.se/docs/adv_20090303.html", }, { name: "34202", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/34202", }, { name: "20090312 rPSA-2009-0042-1 curl", tags: [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred", ], url: "http://www.securityfocus.com/archive/1/501757/100/0/threaded", }, { name: "ADV-2009-0581", tags: [ "vdb-entry", "x_refsource_VUPEN", "x_transferred", ], url: "http://www.vupen.com/english/advisories/2009/0581", }, { name: "SSA:2009-069-01", tags: [ "vendor-advisory", "x_refsource_SLACKWARE", "x_transferred", ], url: "http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.476602", }, { name: "[Security-announce] 20090710 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://lists.vmware.com/pipermail/security-announce/2009/000060.html", }, { name: "33962", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/33962", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://support.apple.com/kb/HT4077", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://www.withdk.com/archives/Libcurl_arbitrary_file_access.pdf", }, { name: "oval:org.mitre.oval:def:11054", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11054", }, { name: "GLSA-200903-21", tags: [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred", ], url: "http://security.gentoo.org/glsa/glsa-200903-21.xml", }, { name: "oval:org.mitre.oval:def:6074", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6074", }, { name: "1021783", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://www.securitytracker.com/id?1021783", }, { name: "34251", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/34251", }, { name: "34399", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/34399", }, { name: "20090711 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl", tags: [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred", ], url: "http://www.securityfocus.com/archive/1/504849/100/0/threaded", }, { name: "34237", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/34237", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.vmware.com/security/advisories/VMSA-2009-0009.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2009-03-03T00:00:00", descriptions: [ { lang: "en", value: "The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-10-11T19:57:01", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { name: "USN-726-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", ], url: "http://www.ubuntu.com/usn/USN-726-1", }, { name: "34259", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/34259", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://curl.haxx.se/lxr/source/CHANGES", }, { name: "35766", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/35766", }, { name: "34255", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/34255", }, { name: "RHSA-2009:0341", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2009-0341.html", }, { name: "DSA-1738", tags: [ "vendor-advisory", "x_refsource_DEBIAN", ], url: "http://www.debian.org/security/2009/dsa-1738", }, { tags: [ "x_refsource_MISC", ], url: "http://www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/", }, { name: "curl-location-security-bypass(49030)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/49030", }, { name: "ADV-2009-1865", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2009/1865", }, { name: "APPLE-SA-2010-03-29-1", tags: [ "vendor-advisory", "x_refsource_APPLE", ], url: "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0042", }, { name: "SUSE-SR:2009:006", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html", }, { name: "34138", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/34138", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://curl.haxx.se/docs/adv_20090303.html", }, { name: "34202", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/34202", }, { name: "20090312 rPSA-2009-0042-1 curl", tags: [ "mailing-list", "x_refsource_BUGTRAQ", ], url: "http://www.securityfocus.com/archive/1/501757/100/0/threaded", }, { name: "ADV-2009-0581", tags: [ "vdb-entry", "x_refsource_VUPEN", ], url: "http://www.vupen.com/english/advisories/2009/0581", }, { name: "SSA:2009-069-01", tags: [ "vendor-advisory", "x_refsource_SLACKWARE", ], url: "http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.476602", }, { name: "[Security-announce] 20090710 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://lists.vmware.com/pipermail/security-announce/2009/000060.html", }, { name: "33962", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/33962", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://support.apple.com/kb/HT4077", }, { tags: [ "x_refsource_MISC", ], url: "http://www.withdk.com/archives/Libcurl_arbitrary_file_access.pdf", }, { name: "oval:org.mitre.oval:def:11054", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11054", }, { name: "GLSA-200903-21", tags: [ "vendor-advisory", "x_refsource_GENTOO", ], url: "http://security.gentoo.org/glsa/glsa-200903-21.xml", }, { name: "oval:org.mitre.oval:def:6074", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6074", }, { name: "1021783", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://www.securitytracker.com/id?1021783", }, { name: "34251", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/34251", }, { name: "34399", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/34399", }, { name: "20090711 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl", tags: [ "mailing-list", "x_refsource_BUGTRAQ", ], url: "http://www.securityfocus.com/archive/1/504849/100/0/threaded", }, { name: "34237", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/34237", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.vmware.com/security/advisories/VMSA-2009-0009.html", }, ], }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2009-0037", datePublished: "2009-03-05T02:00:00", dateReserved: "2008-12-15T00:00:00", dateUpdated: "2024-08-07T04:17:10.543Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-38545
Vulnerability from cvelistv5
Published
2023-10-18 03:52
Modified
2025-02-13 17:01
Severity ?
EPSS score ?
Summary
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
handshake.
When curl is asked to pass along the host name to the SOCKS5 proxy to allow
that to resolve the address instead of it getting done by curl itself, the
maximum length that host name can be is 255 bytes.
If the host name is detected to be longer, curl switches to local name
resolving and instead passes on the resolved address only. Due to this bug,
the local variable that means "let the host resolve the name" could get the
wrong value during a slow SOCKS5 handshake, and contrary to the intention,
copy the too long host name to the target buffer instead of copying just the
resolved address there.
The target buffer being a heap based buffer, and the host name coming from the
URL that curl has been told to operate with.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:46:56.235Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2023-38545.html", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20231027-0009/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/", }, { tags: [ "x_transferred", ], url: "https://www.secpod.com/blog/high-severity-heap-buffer-overflow-vulnerability/", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214036", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214063", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214057", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214058", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jan/34", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jan/37", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jan/38", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240201-0005/", }, { tags: [ "x_transferred", ], url: "https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868", }, ], title: "CVE Program Container", }, { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2023-38545", options: [ { Exploitation: "PoC", }, { Automatable: "No", }, { "Technical Impact": "Total", }, ], role: "CISA Coordinator", timestamp: "2024-10-17T21:11:03.346985Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "CWE-787 Out-of-bounds Write", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-10-17T21:16:30.994Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, references: [ { tags: [ "exploit", ], url: "https://github.com/bcdannyboy/CVE-2023-38545", }, { tags: [ "exploit", ], url: "https://github.com/dbrugman/CVE-2023-38545-POC", }, { tags: [ "exploit", ], url: "https://github.com/UTsweetyfish/CVE-2023-38545", }, ], title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "curl", vendor: "curl", versions: [ { lessThan: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThan: "7.69.0", status: "unaffected", version: "7.69.0", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.", }, ], providerMetadata: { dateUpdated: "2024-07-09T13:27:08.128Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "https://curl.se/docs/CVE-2023-38545.html", }, { url: "https://security.netapp.com/advisory/ntap-20231027-0009/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/", }, { url: "https://www.secpod.com/blog/high-severity-heap-buffer-overflow-vulnerability/", }, { url: "https://support.apple.com/kb/HT214036", }, { url: "https://support.apple.com/kb/HT214063", }, { url: "https://support.apple.com/kb/HT214057", }, { url: "https://support.apple.com/kb/HT214058", }, { url: "http://seclists.org/fulldisclosure/2024/Jan/34", }, { url: "http://seclists.org/fulldisclosure/2024/Jan/37", }, { url: "http://seclists.org/fulldisclosure/2024/Jan/38", }, { url: "https://security.netapp.com/advisory/ntap-20240201-0005/", }, { url: "https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2023-38545", datePublished: "2023-10-18T03:52:00.816Z", dateReserved: "2023-07-20T01:00:12.444Z", dateUpdated: "2025-02-13T17:01:52.930Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-38546
Vulnerability from cvelistv5
Published
2023-10-18 03:51
Modified
2025-02-13 17:01
Severity ?
EPSS score ?
Summary
This flaw allows an attacker to insert cookies at will into a running program
using libcurl, if the specific series of conditions are met.
libcurl performs transfers. In its API, an application creates "easy handles"
that are the individual handles for single transfers.
libcurl provides a function call that duplicates en easy handle called
[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).
If a transfer has cookies enabled when the handle is duplicated, the
cookie-enable state is also cloned - but without cloning the actual
cookies. If the source handle did not read any cookies from a specific file on
disk, the cloned version of the handle would instead store the file name as
`none` (using the four ASCII letters, no quotes).
Subsequent use of the cloned handle that does not explicitly set a source to
load cookies from would then inadvertently load cookies from a file named
`none` - if such a file exists and is readable in the current directory of the
program using libcurl. And if using the correct file format of course.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:46:55.785Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2023-38546.html", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214036", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214063", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214057", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214058", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jan/34", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jan/37", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jan/38", }, { tags: [ "x_transferred", ], url: "https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-38546", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-09-13T15:01:53.358515Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-09-13T15:02:37.137Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "curl", vendor: "curl", versions: [ { lessThan: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThan: "7.9.1", status: "unaffected", version: "7.9.1", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "This flaw allows an attacker to insert cookies at will into a running program\nusing libcurl, if the specific series of conditions are met.\n\nlibcurl performs transfers. In its API, an application creates \"easy handles\"\nthat are the individual handles for single transfers.\n\nlibcurl provides a function call that duplicates en easy handle called\n[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).\n\nIf a transfer has cookies enabled when the handle is duplicated, the\ncookie-enable state is also cloned - but without cloning the actual\ncookies. If the source handle did not read any cookies from a specific file on\ndisk, the cloned version of the handle would instead store the file name as\n`none` (using the four ASCII letters, no quotes).\n\nSubsequent use of the cloned handle that does not explicitly set a source to\nload cookies from would then inadvertently load cookies from a file named\n`none` - if such a file exists and is readable in the current directory of the\nprogram using libcurl. And if using the correct file format of course.", }, ], providerMetadata: { dateUpdated: "2024-07-09T13:27:34.245Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "https://curl.se/docs/CVE-2023-38546.html", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/", }, { url: "https://support.apple.com/kb/HT214036", }, { url: "https://support.apple.com/kb/HT214063", }, { url: "https://support.apple.com/kb/HT214057", }, { url: "https://support.apple.com/kb/HT214058", }, { url: "http://seclists.org/fulldisclosure/2024/Jan/34", }, { url: "http://seclists.org/fulldisclosure/2024/Jan/37", }, { url: "http://seclists.org/fulldisclosure/2024/Jan/38", }, { url: "https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2023-38546", datePublished: "2023-10-18T03:51:31.276Z", dateReserved: "2023-07-20T01:00:12.444Z", dateUpdated: "2025-02-13T17:01:53.507Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-11053
Vulnerability from cvelistv5
Published
2024-12-11 07:34
Modified
2025-01-31 15:02
Severity ?
EPSS score ?
Summary
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches
the redirect target hostname but the entry either omits just the password or
omits both login and password.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| curl | curl |
Version: 8.11.0 ≤ 8.11.0 Version: 8.10.1 ≤ 8.10.1 Version: 8.10.0 ≤ 8.10.0 Version: 8.9.1 ≤ 8.9.1 Version: 8.9.0 ≤ 8.9.0 Version: 8.8.0 ≤ 8.8.0 Version: 8.7.1 ≤ 8.7.1 Version: 8.7.0 ≤ 8.7.0 Version: 8.6.0 ≤ 8.6.0 Version: 8.5.0 ≤ 8.5.0 Version: 8.4.0 ≤ 8.4.0 Version: 8.3.0 ≤ 8.3.0 Version: 8.2.1 ≤ 8.2.1 Version: 8.2.0 ≤ 8.2.0 Version: 8.1.2 ≤ 8.1.2 Version: 8.1.1 ≤ 8.1.1 Version: 8.1.0 ≤ 8.1.0 Version: 8.0.1 ≤ 8.0.1 Version: 8.0.0 ≤ 8.0.0 Version: 7.88.1 ≤ 7.88.1 Version: 7.88.0 ≤ 7.88.0 Version: 7.87.0 ≤ 7.87.0 Version: 7.86.0 ≤ 7.86.0 Version: 7.85.0 ≤ 7.85.0 Version: 7.84.0 ≤ 7.84.0 Version: 7.83.1 ≤ 7.83.1 Version: 7.83.0 ≤ 7.83.0 Version: 7.82.0 ≤ 7.82.0 Version: 7.81.0 ≤ 7.81.0 Version: 7.80.0 ≤ 7.80.0 Version: 7.79.1 ≤ 7.79.1 Version: 7.79.0 ≤ 7.79.0 Version: 7.78.0 ≤ 7.78.0 Version: 7.77.0 ≤ 7.77.0 Version: 7.76.1 ≤ 7.76.1 Version: 7.76.0 ≤ 7.76.0 Version: 7.75.0 ≤ 7.75.0 Version: 7.74.0 ≤ 7.74.0 Version: 7.73.0 ≤ 7.73.0 Version: 7.72.0 ≤ 7.72.0 Version: 7.71.1 ≤ 7.71.1 Version: 7.71.0 ≤ 7.71.0 Version: 7.70.0 ≤ 7.70.0 Version: 7.69.1 ≤ 7.69.1 Version: 7.69.0 ≤ 7.69.0 Version: 7.68.0 ≤ 7.68.0 Version: 7.67.0 ≤ 7.67.0 Version: 7.66.0 ≤ 7.66.0 Version: 7.65.3 ≤ 7.65.3 Version: 7.65.2 ≤ 7.65.2 Version: 7.65.1 ≤ 7.65.1 Version: 7.65.0 ≤ 7.65.0 Version: 7.64.1 ≤ 7.64.1 Version: 7.64.0 ≤ 7.64.0 Version: 7.63.0 ≤ 7.63.0 Version: 7.62.0 ≤ 7.62.0 Version: 7.61.1 ≤ 7.61.1 Version: 7.61.0 ≤ 7.61.0 Version: 7.60.0 ≤ 7.60.0 Version: 7.59.0 ≤ 7.59.0 Version: 7.58.0 ≤ 7.58.0 Version: 7.57.0 ≤ 7.57.0 Version: 7.56.1 ≤ 7.56.1 Version: 7.56.0 ≤ 7.56.0 Version: 7.55.1 ≤ 7.55.1 Version: 7.55.0 ≤ 7.55.0 Version: 7.54.1 ≤ 7.54.1 Version: 7.54.0 ≤ 7.54.0 Version: 7.53.1 ≤ 7.53.1 Version: 7.53.0 ≤ 7.53.0 Version: 7.52.1 ≤ 7.52.1 Version: 7.52.0 ≤ 7.52.0 Version: 7.51.0 ≤ 7.51.0 Version: 7.50.3 ≤ 7.50.3 Version: 7.50.2 ≤ 7.50.2 Version: 7.50.1 ≤ 7.50.1 Version: 7.50.0 ≤ 7.50.0 Version: 7.49.1 ≤ 7.49.1 Version: 7.49.0 ≤ 7.49.0 Version: 7.48.0 ≤ 7.48.0 Version: 7.47.1 ≤ 7.47.1 Version: 7.47.0 ≤ 7.47.0 Version: 7.46.0 ≤ 7.46.0 Version: 7.45.0 ≤ 7.45.0 Version: 7.44.0 ≤ 7.44.0 Version: 7.43.0 ≤ 7.43.0 Version: 7.42.1 ≤ 7.42.1 Version: 7.42.0 ≤ 7.42.0 Version: 7.41.0 ≤ 7.41.0 Version: 7.40.0 ≤ 7.40.0 Version: 7.39.0 ≤ 7.39.0 Version: 7.38.0 ≤ 7.38.0 Version: 7.37.1 ≤ 7.37.1 Version: 7.37.0 ≤ 7.37.0 Version: 7.36.0 ≤ 7.36.0 Version: 7.35.0 ≤ 7.35.0 Version: 7.34.0 ≤ 7.34.0 Version: 7.33.0 ≤ 7.33.0 Version: 7.32.0 ≤ 7.32.0 Version: 7.31.0 ≤ 7.31.0 Version: 7.30.0 ≤ 7.30.0 Version: 7.29.0 ≤ 7.29.0 Version: 7.28.1 ≤ 7.28.1 Version: 7.28.0 ≤ 7.28.0 Version: 7.27.0 ≤ 7.27.0 Version: 7.26.0 ≤ 7.26.0 Version: 7.25.0 ≤ 7.25.0 Version: 7.24.0 ≤ 7.24.0 Version: 7.23.1 ≤ 7.23.1 Version: 7.23.0 ≤ 7.23.0 Version: 7.22.0 ≤ 7.22.0 Version: 7.21.7 ≤ 7.21.7 Version: 7.21.6 ≤ 7.21.6 Version: 7.21.5 ≤ 7.21.5 Version: 7.21.4 ≤ 7.21.4 Version: 7.21.3 ≤ 7.21.3 Version: 7.21.2 ≤ 7.21.2 Version: 7.21.1 ≤ 7.21.1 Version: 7.21.0 ≤ 7.21.0 Version: 7.20.1 ≤ 7.20.1 Version: 7.20.0 ≤ 7.20.0 Version: 7.19.7 ≤ 7.19.7 Version: 7.19.6 ≤ 7.19.6 Version: 7.19.5 ≤ 7.19.5 Version: 7.19.4 ≤ 7.19.4 Version: 7.19.3 ≤ 7.19.3 Version: 7.19.2 ≤ 7.19.2 Version: 7.19.1 ≤ 7.19.1 Version: 7.19.0 ≤ 7.19.0 Version: 7.18.2 ≤ 7.18.2 Version: 7.18.1 ≤ 7.18.1 Version: 7.18.0 ≤ 7.18.0 Version: 7.17.1 ≤ 7.17.1 Version: 7.17.0 ≤ 7.17.0 Version: 7.16.4 ≤ 7.16.4 Version: 7.16.3 ≤ 7.16.3 Version: 7.16.2 ≤ 7.16.2 Version: 7.16.1 ≤ 7.16.1 Version: 7.16.0 ≤ 7.16.0 Version: 7.15.5 ≤ 7.15.5 Version: 7.15.4 ≤ 7.15.4 Version: 7.15.3 ≤ 7.15.3 Version: 7.15.2 ≤ 7.15.2 Version: 7.15.1 ≤ 7.15.1 Version: 7.15.0 ≤ 7.15.0 Version: 7.14.1 ≤ 7.14.1 Version: 7.14.0 ≤ 7.14.0 Version: 7.13.2 ≤ 7.13.2 Version: 7.13.1 ≤ 7.13.1 Version: 7.13.0 ≤ 7.13.0 Version: 7.12.3 ≤ 7.12.3 Version: 7.12.2 ≤ 7.12.2 Version: 7.12.1 ≤ 7.12.1 Version: 7.12.0 ≤ 7.12.0 Version: 7.11.2 ≤ 7.11.2 Version: 7.11.1 ≤ 7.11.1 Version: 7.11.0 ≤ 7.11.0 Version: 7.10.8 ≤ 7.10.8 Version: 7.10.7 ≤ 7.10.7 Version: 7.10.6 ≤ 7.10.6 Version: 7.10.5 ≤ 7.10.5 Version: 7.10.4 ≤ 7.10.4 Version: 7.10.3 ≤ 7.10.3 Version: 7.10.2 ≤ 7.10.2 Version: 7.10.1 ≤ 7.10.1 Version: 7.10 ≤ 7.10 Version: 7.9.8 ≤ 7.9.8 Version: 7.9.7 ≤ 7.9.7 Version: 7.9.6 ≤ 7.9.6 Version: 7.9.5 ≤ 7.9.5 Version: 7.9.4 ≤ 7.9.4 Version: 7.9.3 ≤ 7.9.3 Version: 7.9.2 ≤ 7.9.2 Version: 7.9.1 ≤ 7.9.1 Version: 7.9 ≤ 7.9 Version: 7.8.1 ≤ 7.8.1 Version: 7.8 ≤ 7.8 Version: 7.7.3 ≤ 7.7.3 Version: 7.7.2 ≤ 7.7.2 Version: 7.7.1 ≤ 7.7.1 Version: 7.7 ≤ 7.7 Version: 7.6.1 ≤ 7.6.1 Version: 7.6 ≤ 7.6 Version: 7.5.2 ≤ 7.5.2 Version: 7.5.1 ≤ 7.5.1 Version: 7.5 ≤ 7.5 Version: 7.4.2 ≤ 7.4.2 Version: 7.4.1 ≤ 7.4.1 Version: 7.4 ≤ 7.4 Version: 7.3 ≤ 7.3 Version: 7.2.1 ≤ 7.2.1 Version: 7.2 ≤ 7.2 Version: 7.1.1 ≤ 7.1.1 Version: 7.1 ≤ 7.1 Version: 6.5.2 ≤ 6.5.2 Version: 6.5.1 ≤ 6.5.1 Version: 6.5 ≤ 6.5 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2025-01-31T15:02:42.742Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "http://www.openwall.com/lists/oss-security/2024/12/11/1", }, { url: "https://security.netapp.com/advisory/ntap-20250124-0012/", }, { url: "https://security.netapp.com/advisory/ntap-20250131-0003/", }, ], title: "CVE Program Container", }, { metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-11053", options: [ { Exploitation: "poc", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-15T16:47:42.738403Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-15T16:50:59.398Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.11.0", status: "affected", version: "8.11.0", versionType: "semver", }, { lessThanOrEqual: "8.10.1", status: "affected", version: "8.10.1", versionType: "semver", }, { lessThanOrEqual: "8.10.0", status: "affected", version: "8.10.0", versionType: "semver", }, { lessThanOrEqual: "8.9.1", status: "affected", version: "8.9.1", versionType: "semver", }, { lessThanOrEqual: "8.9.0", status: "affected", version: "8.9.0", versionType: "semver", }, { lessThanOrEqual: "8.8.0", status: "affected", version: "8.8.0", versionType: "semver", }, { lessThanOrEqual: "8.7.1", status: "affected", version: "8.7.1", versionType: "semver", }, { lessThanOrEqual: "8.7.0", status: "affected", version: "8.7.0", versionType: "semver", }, { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, { lessThanOrEqual: "8.5.0", status: "affected", version: "8.5.0", versionType: "semver", }, { lessThanOrEqual: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThanOrEqual: "8.3.0", status: "affected", version: "8.3.0", versionType: "semver", }, { lessThanOrEqual: "8.2.1", status: "affected", version: "8.2.1", versionType: "semver", }, { lessThanOrEqual: "8.2.0", status: "affected", version: "8.2.0", versionType: "semver", }, { lessThanOrEqual: "8.1.2", status: "affected", version: "8.1.2", versionType: "semver", }, { lessThanOrEqual: "8.1.1", status: "affected", version: "8.1.1", versionType: "semver", }, { lessThanOrEqual: "8.1.0", status: "affected", version: "8.1.0", versionType: "semver", }, { lessThanOrEqual: "8.0.1", status: "affected", version: "8.0.1", versionType: "semver", }, { lessThanOrEqual: "8.0.0", status: "affected", version: "8.0.0", versionType: "semver", }, { lessThanOrEqual: "7.88.1", status: "affected", version: "7.88.1", versionType: "semver", }, { lessThanOrEqual: "7.88.0", status: "affected", version: "7.88.0", versionType: "semver", }, { lessThanOrEqual: "7.87.0", status: "affected", version: "7.87.0", versionType: "semver", }, { lessThanOrEqual: "7.86.0", status: "affected", version: "7.86.0", versionType: "semver", }, { lessThanOrEqual: "7.85.0", status: "affected", version: "7.85.0", versionType: "semver", }, { lessThanOrEqual: "7.84.0", status: "affected", version: "7.84.0", versionType: "semver", }, { lessThanOrEqual: "7.83.1", status: "affected", version: "7.83.1", versionType: "semver", }, { lessThanOrEqual: "7.83.0", status: "affected", version: "7.83.0", versionType: "semver", }, { lessThanOrEqual: "7.82.0", status: "affected", version: "7.82.0", versionType: "semver", }, { lessThanOrEqual: "7.81.0", status: "affected", version: "7.81.0", versionType: "semver", }, { lessThanOrEqual: "7.80.0", status: "affected", version: "7.80.0", versionType: "semver", }, { lessThanOrEqual: "7.79.1", status: "affected", version: "7.79.1", versionType: "semver", }, { lessThanOrEqual: "7.79.0", status: "affected", version: "7.79.0", versionType: "semver", }, { lessThanOrEqual: "7.78.0", status: "affected", version: "7.78.0", versionType: "semver", }, { lessThanOrEqual: "7.77.0", status: "affected", version: "7.77.0", versionType: "semver", }, { lessThanOrEqual: "7.76.1", status: "affected", version: "7.76.1", versionType: "semver", }, { lessThanOrEqual: "7.76.0", status: "affected", version: "7.76.0", versionType: "semver", }, { lessThanOrEqual: "7.75.0", status: "affected", version: "7.75.0", versionType: "semver", }, { lessThanOrEqual: "7.74.0", status: "affected", version: "7.74.0", versionType: "semver", }, { lessThanOrEqual: "7.73.0", status: "affected", version: "7.73.0", versionType: "semver", }, { lessThanOrEqual: "7.72.0", status: "affected", version: "7.72.0", versionType: "semver", }, { lessThanOrEqual: "7.71.1", status: "affected", version: "7.71.1", versionType: "semver", }, { lessThanOrEqual: "7.71.0", status: "affected", version: "7.71.0", versionType: "semver", }, { lessThanOrEqual: "7.70.0", status: "affected", version: "7.70.0", versionType: "semver", }, { lessThanOrEqual: "7.69.1", status: "affected", version: "7.69.1", versionType: "semver", }, { lessThanOrEqual: "7.69.0", status: "affected", version: "7.69.0", versionType: "semver", }, { lessThanOrEqual: "7.68.0", status: "affected", version: "7.68.0", versionType: "semver", }, { lessThanOrEqual: "7.67.0", status: "affected", version: "7.67.0", versionType: "semver", }, { lessThanOrEqual: "7.66.0", status: "affected", version: "7.66.0", versionType: "semver", }, { lessThanOrEqual: "7.65.3", status: "affected", version: "7.65.3", versionType: "semver", }, { lessThanOrEqual: "7.65.2", status: "affected", version: "7.65.2", versionType: "semver", }, { lessThanOrEqual: "7.65.1", status: "affected", version: "7.65.1", versionType: "semver", }, { lessThanOrEqual: "7.65.0", status: "affected", version: "7.65.0", versionType: "semver", }, { lessThanOrEqual: "7.64.1", status: "affected", version: "7.64.1", versionType: "semver", }, { lessThanOrEqual: "7.64.0", status: "affected", version: "7.64.0", versionType: "semver", }, { lessThanOrEqual: "7.63.0", status: "affected", version: "7.63.0", versionType: "semver", }, { lessThanOrEqual: "7.62.0", status: "affected", version: "7.62.0", versionType: "semver", }, { lessThanOrEqual: "7.61.1", status: "affected", version: "7.61.1", versionType: "semver", }, { lessThanOrEqual: "7.61.0", status: "affected", version: "7.61.0", versionType: "semver", }, { lessThanOrEqual: "7.60.0", status: "affected", version: "7.60.0", versionType: "semver", }, { lessThanOrEqual: "7.59.0", status: "affected", version: "7.59.0", versionType: "semver", }, { lessThanOrEqual: "7.58.0", status: "affected", version: "7.58.0", versionType: "semver", }, { lessThanOrEqual: "7.57.0", status: "affected", version: "7.57.0", versionType: "semver", }, { lessThanOrEqual: "7.56.1", status: "affected", version: "7.56.1", versionType: "semver", }, { lessThanOrEqual: "7.56.0", status: "affected", version: "7.56.0", versionType: "semver", }, { lessThanOrEqual: "7.55.1", status: "affected", version: "7.55.1", versionType: "semver", }, { lessThanOrEqual: "7.55.0", status: "affected", version: "7.55.0", versionType: "semver", }, { lessThanOrEqual: "7.54.1", status: "affected", version: "7.54.1", versionType: "semver", }, { lessThanOrEqual: "7.54.0", status: "affected", version: "7.54.0", versionType: "semver", }, { lessThanOrEqual: "7.53.1", status: "affected", version: "7.53.1", versionType: "semver", }, { lessThanOrEqual: "7.53.0", status: "affected", version: "7.53.0", versionType: "semver", }, { lessThanOrEqual: "7.52.1", status: "affected", version: "7.52.1", versionType: "semver", }, { lessThanOrEqual: "7.52.0", status: "affected", version: "7.52.0", versionType: "semver", }, { lessThanOrEqual: "7.51.0", status: "affected", version: "7.51.0", versionType: "semver", }, { lessThanOrEqual: "7.50.3", status: "affected", version: "7.50.3", versionType: "semver", }, { lessThanOrEqual: "7.50.2", status: "affected", version: "7.50.2", versionType: "semver", }, { lessThanOrEqual: "7.50.1", status: "affected", version: "7.50.1", versionType: "semver", }, { lessThanOrEqual: "7.50.0", status: "affected", version: "7.50.0", versionType: "semver", }, { lessThanOrEqual: "7.49.1", status: "affected", version: "7.49.1", versionType: "semver", }, { lessThanOrEqual: "7.49.0", status: "affected", version: "7.49.0", versionType: "semver", }, { lessThanOrEqual: "7.48.0", status: "affected", version: "7.48.0", versionType: "semver", }, { lessThanOrEqual: "7.47.1", status: "affected", version: "7.47.1", versionType: "semver", }, { lessThanOrEqual: "7.47.0", status: "affected", version: "7.47.0", versionType: "semver", }, { lessThanOrEqual: "7.46.0", status: "affected", version: "7.46.0", versionType: "semver", }, { lessThanOrEqual: "7.45.0", status: "affected", version: "7.45.0", versionType: "semver", }, { lessThanOrEqual: "7.44.0", status: "affected", version: "7.44.0", versionType: "semver", }, { lessThanOrEqual: "7.43.0", status: "affected", version: "7.43.0", versionType: "semver", }, { lessThanOrEqual: "7.42.1", status: "affected", version: "7.42.1", versionType: "semver", }, { lessThanOrEqual: "7.42.0", status: "affected", version: "7.42.0", versionType: "semver", }, { lessThanOrEqual: "7.41.0", status: "affected", version: "7.41.0", versionType: "semver", }, { lessThanOrEqual: "7.40.0", status: "affected", version: "7.40.0", versionType: "semver", }, { lessThanOrEqual: "7.39.0", status: "affected", version: "7.39.0", versionType: "semver", }, { lessThanOrEqual: "7.38.0", status: "affected", version: "7.38.0", versionType: "semver", }, { lessThanOrEqual: "7.37.1", status: "affected", version: "7.37.1", versionType: "semver", }, { lessThanOrEqual: "7.37.0", status: "affected", version: "7.37.0", versionType: "semver", }, { lessThanOrEqual: "7.36.0", status: "affected", version: "7.36.0", versionType: "semver", }, { lessThanOrEqual: "7.35.0", status: "affected", version: "7.35.0", versionType: "semver", }, { lessThanOrEqual: "7.34.0", status: "affected", version: "7.34.0", versionType: "semver", }, { lessThanOrEqual: "7.33.0", status: "affected", version: "7.33.0", versionType: "semver", }, { lessThanOrEqual: "7.32.0", status: "affected", version: "7.32.0", versionType: "semver", }, { lessThanOrEqual: "7.31.0", status: "affected", version: "7.31.0", versionType: "semver", }, { lessThanOrEqual: "7.30.0", status: "affected", version: "7.30.0", versionType: "semver", }, { lessThanOrEqual: "7.29.0", status: "affected", version: "7.29.0", versionType: "semver", }, { lessThanOrEqual: "7.28.1", status: "affected", version: "7.28.1", versionType: "semver", }, { lessThanOrEqual: "7.28.0", status: "affected", version: "7.28.0", versionType: "semver", }, { lessThanOrEqual: "7.27.0", status: "affected", version: "7.27.0", versionType: "semver", }, { lessThanOrEqual: "7.26.0", status: "affected", version: "7.26.0", versionType: "semver", }, { lessThanOrEqual: "7.25.0", status: "affected", version: "7.25.0", versionType: "semver", }, { lessThanOrEqual: "7.24.0", status: "affected", version: "7.24.0", versionType: "semver", }, { lessThanOrEqual: "7.23.1", status: "affected", version: "7.23.1", versionType: "semver", }, { lessThanOrEqual: "7.23.0", status: "affected", version: "7.23.0", versionType: "semver", }, { lessThanOrEqual: "7.22.0", status: "affected", version: "7.22.0", versionType: "semver", }, { lessThanOrEqual: "7.21.7", status: "affected", version: "7.21.7", versionType: "semver", }, { lessThanOrEqual: "7.21.6", status: "affected", version: "7.21.6", versionType: "semver", }, { lessThanOrEqual: "7.21.5", status: "affected", version: "7.21.5", versionType: "semver", }, { lessThanOrEqual: "7.21.4", status: "affected", version: "7.21.4", versionType: "semver", }, { lessThanOrEqual: "7.21.3", status: "affected", version: "7.21.3", versionType: "semver", }, { lessThanOrEqual: "7.21.2", status: "affected", version: "7.21.2", versionType: "semver", }, { lessThanOrEqual: "7.21.1", status: "affected", version: "7.21.1", versionType: "semver", }, { lessThanOrEqual: "7.21.0", status: "affected", version: "7.21.0", versionType: "semver", }, { lessThanOrEqual: "7.20.1", status: "affected", version: "7.20.1", versionType: "semver", }, { lessThanOrEqual: "7.20.0", status: "affected", version: "7.20.0", versionType: "semver", }, { lessThanOrEqual: "7.19.7", status: "affected", version: "7.19.7", versionType: "semver", }, { lessThanOrEqual: "7.19.6", status: "affected", version: "7.19.6", versionType: "semver", }, { lessThanOrEqual: "7.19.5", status: "affected", version: "7.19.5", versionType: "semver", }, { lessThanOrEqual: "7.19.4", status: "affected", version: "7.19.4", versionType: "semver", }, { lessThanOrEqual: "7.19.3", status: "affected", version: "7.19.3", versionType: "semver", }, { lessThanOrEqual: "7.19.2", status: "affected", version: "7.19.2", versionType: "semver", }, { lessThanOrEqual: "7.19.1", status: "affected", version: "7.19.1", versionType: "semver", }, { lessThanOrEqual: "7.19.0", status: "affected", version: "7.19.0", versionType: "semver", }, { lessThanOrEqual: "7.18.2", status: "affected", version: "7.18.2", versionType: "semver", }, { lessThanOrEqual: "7.18.1", status: "affected", version: "7.18.1", versionType: "semver", }, { lessThanOrEqual: "7.18.0", status: "affected", version: "7.18.0", versionType: "semver", }, { lessThanOrEqual: "7.17.1", status: "affected", version: "7.17.1", versionType: "semver", }, { lessThanOrEqual: "7.17.0", status: "affected", version: "7.17.0", versionType: "semver", }, { lessThanOrEqual: "7.16.4", status: "affected", version: "7.16.4", versionType: "semver", }, { lessThanOrEqual: "7.16.3", status: "affected", version: "7.16.3", versionType: "semver", }, { lessThanOrEqual: "7.16.2", status: "affected", version: "7.16.2", versionType: "semver", }, { lessThanOrEqual: "7.16.1", status: "affected", version: "7.16.1", versionType: "semver", }, { lessThanOrEqual: "7.16.0", status: "affected", version: "7.16.0", versionType: "semver", }, { lessThanOrEqual: "7.15.5", status: "affected", version: "7.15.5", versionType: "semver", }, { lessThanOrEqual: "7.15.4", status: "affected", version: "7.15.4", versionType: "semver", }, { lessThanOrEqual: "7.15.3", status: "affected", version: "7.15.3", versionType: "semver", }, { lessThanOrEqual: "7.15.2", status: "affected", version: "7.15.2", versionType: "semver", }, { lessThanOrEqual: "7.15.1", status: "affected", version: "7.15.1", versionType: "semver", }, { lessThanOrEqual: "7.15.0", status: "affected", version: "7.15.0", versionType: "semver", }, { lessThanOrEqual: "7.14.1", status: "affected", version: "7.14.1", versionType: "semver", }, { lessThanOrEqual: "7.14.0", status: "affected", version: "7.14.0", versionType: "semver", }, { lessThanOrEqual: "7.13.2", status: "affected", version: "7.13.2", versionType: "semver", }, { lessThanOrEqual: "7.13.1", status: "affected", version: "7.13.1", versionType: "semver", }, { lessThanOrEqual: "7.13.0", status: "affected", version: "7.13.0", versionType: "semver", }, { lessThanOrEqual: "7.12.3", status: "affected", version: "7.12.3", versionType: "semver", }, { lessThanOrEqual: "7.12.2", status: "affected", version: "7.12.2", versionType: "semver", }, { lessThanOrEqual: "7.12.1", status: "affected", version: "7.12.1", versionType: "semver", }, { lessThanOrEqual: "7.12.0", status: "affected", version: "7.12.0", versionType: "semver", }, { lessThanOrEqual: "7.11.2", status: "affected", version: "7.11.2", versionType: "semver", }, { lessThanOrEqual: "7.11.1", status: "affected", version: "7.11.1", versionType: "semver", }, { lessThanOrEqual: "7.11.0", status: "affected", version: "7.11.0", versionType: "semver", }, { lessThanOrEqual: "7.10.8", status: "affected", version: "7.10.8", versionType: "semver", }, { lessThanOrEqual: "7.10.7", status: "affected", version: "7.10.7", versionType: "semver", }, { lessThanOrEqual: "7.10.6", status: "affected", version: "7.10.6", versionType: "semver", }, { lessThanOrEqual: "7.10.5", status: "affected", version: "7.10.5", versionType: "semver", }, { lessThanOrEqual: "7.10.4", status: "affected", version: "7.10.4", versionType: "semver", }, { lessThanOrEqual: "7.10.3", status: "affected", version: "7.10.3", versionType: "semver", }, { lessThanOrEqual: "7.10.2", status: "affected", version: "7.10.2", versionType: "semver", }, { lessThanOrEqual: "7.10.1", status: "affected", version: "7.10.1", versionType: "semver", }, { lessThanOrEqual: "7.10", status: "affected", version: "7.10", versionType: "semver", }, { lessThanOrEqual: "7.9.8", status: "affected", version: "7.9.8", versionType: "semver", }, { lessThanOrEqual: "7.9.7", status: "affected", version: "7.9.7", versionType: "semver", }, { lessThanOrEqual: "7.9.6", status: "affected", version: "7.9.6", versionType: "semver", }, { lessThanOrEqual: "7.9.5", status: "affected", version: "7.9.5", versionType: "semver", }, { lessThanOrEqual: "7.9.4", status: "affected", version: "7.9.4", versionType: "semver", }, { lessThanOrEqual: "7.9.3", status: "affected", version: "7.9.3", versionType: "semver", }, { lessThanOrEqual: "7.9.2", status: "affected", version: "7.9.2", versionType: "semver", }, { lessThanOrEqual: "7.9.1", status: "affected", version: "7.9.1", versionType: "semver", }, { lessThanOrEqual: "7.9", status: "affected", version: "7.9", versionType: "semver", }, { lessThanOrEqual: "7.8.1", status: "affected", version: "7.8.1", versionType: "semver", }, { lessThanOrEqual: "7.8", status: "affected", version: "7.8", versionType: "semver", }, { lessThanOrEqual: "7.7.3", status: "affected", version: "7.7.3", versionType: "semver", }, { lessThanOrEqual: "7.7.2", status: "affected", version: "7.7.2", versionType: "semver", }, { lessThanOrEqual: "7.7.1", status: "affected", version: "7.7.1", versionType: "semver", }, { lessThanOrEqual: "7.7", status: "affected", version: "7.7", versionType: "semver", }, { lessThanOrEqual: "7.6.1", status: "affected", version: "7.6.1", versionType: "semver", }, { lessThanOrEqual: "7.6", status: "affected", version: "7.6", versionType: "semver", }, { lessThanOrEqual: "7.5.2", status: "affected", version: "7.5.2", versionType: "semver", }, { lessThanOrEqual: "7.5.1", status: "affected", version: "7.5.1", versionType: "semver", }, { lessThanOrEqual: "7.5", status: "affected", version: "7.5", versionType: "semver", }, { lessThanOrEqual: "7.4.2", status: "affected", version: "7.4.2", versionType: "semver", }, { lessThanOrEqual: "7.4.1", status: "affected", version: "7.4.1", versionType: "semver", }, { lessThanOrEqual: "7.4", status: "affected", version: "7.4", versionType: "semver", }, { lessThanOrEqual: "7.3", status: "affected", version: "7.3", versionType: "semver", }, { lessThanOrEqual: "7.2.1", status: "affected", version: "7.2.1", versionType: "semver", }, { lessThanOrEqual: "7.2", status: "affected", version: "7.2", versionType: "semver", }, { lessThanOrEqual: "7.1.1", status: "affected", version: "7.1.1", versionType: "semver", }, { lessThanOrEqual: "7.1", status: "affected", version: "7.1", versionType: "semver", }, { lessThanOrEqual: "6.5.2", status: "affected", version: "6.5.2", versionType: "semver", }, { lessThanOrEqual: "6.5.1", status: "affected", version: "6.5.1", versionType: "semver", }, { lessThanOrEqual: "6.5", status: "affected", version: "6.5", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Harry Sintonen", }, { lang: "en", type: "remediation developer", value: "Daniel Stenberg", }, ], descriptions: [ { lang: "en", value: "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-11T07:34:29.539Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-11053.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-11053.html", }, { name: "issue", url: "https://hackerone.com/reports/2829063", }, ], title: "netrc and redirect credential leak", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-11053", datePublished: "2024-12-11T07:34:29.539Z", dateReserved: "2024-11-09T18:41:55.703Z", dateUpdated: "2025-01-31T15:02:42.742Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-8096
Vulnerability from cvelistv5
Published
2024-09-11 10:03
Modified
2024-11-14 17:02
Severity ?
EPSS score ?
Summary
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| curl | curl |
Version: 8.9.1 ≤ 8.9.1 Version: 8.9.0 ≤ 8.9.0 Version: 8.8.0 ≤ 8.8.0 Version: 8.7.1 ≤ 8.7.1 Version: 8.7.0 ≤ 8.7.0 Version: 8.6.0 ≤ 8.6.0 Version: 8.5.0 ≤ 8.5.0 Version: 8.4.0 ≤ 8.4.0 Version: 8.3.0 ≤ 8.3.0 Version: 8.2.1 ≤ 8.2.1 Version: 8.2.0 ≤ 8.2.0 Version: 8.1.2 ≤ 8.1.2 Version: 8.1.1 ≤ 8.1.1 Version: 8.1.0 ≤ 8.1.0 Version: 8.0.1 ≤ 8.0.1 Version: 8.0.0 ≤ 8.0.0 Version: 7.88.1 ≤ 7.88.1 Version: 7.88.0 ≤ 7.88.0 Version: 7.87.0 ≤ 7.87.0 Version: 7.86.0 ≤ 7.86.0 Version: 7.85.0 ≤ 7.85.0 Version: 7.84.0 ≤ 7.84.0 Version: 7.83.1 ≤ 7.83.1 Version: 7.83.0 ≤ 7.83.0 Version: 7.82.0 ≤ 7.82.0 Version: 7.81.0 ≤ 7.81.0 Version: 7.80.0 ≤ 7.80.0 Version: 7.79.1 ≤ 7.79.1 Version: 7.79.0 ≤ 7.79.0 Version: 7.78.0 ≤ 7.78.0 Version: 7.77.0 ≤ 7.77.0 Version: 7.76.1 ≤ 7.76.1 Version: 7.76.0 ≤ 7.76.0 Version: 7.75.0 ≤ 7.75.0 Version: 7.74.0 ≤ 7.74.0 Version: 7.73.0 ≤ 7.73.0 Version: 7.72.0 ≤ 7.72.0 Version: 7.71.1 ≤ 7.71.1 Version: 7.71.0 ≤ 7.71.0 Version: 7.70.0 ≤ 7.70.0 Version: 7.69.1 ≤ 7.69.1 Version: 7.69.0 ≤ 7.69.0 Version: 7.68.0 ≤ 7.68.0 Version: 7.67.0 ≤ 7.67.0 Version: 7.66.0 ≤ 7.66.0 Version: 7.65.3 ≤ 7.65.3 Version: 7.65.2 ≤ 7.65.2 Version: 7.65.1 ≤ 7.65.1 Version: 7.65.0 ≤ 7.65.0 Version: 7.64.1 ≤ 7.64.1 Version: 7.64.0 ≤ 7.64.0 Version: 7.63.0 ≤ 7.63.0 Version: 7.62.0 ≤ 7.62.0 Version: 7.61.1 ≤ 7.61.1 Version: 7.61.0 ≤ 7.61.0 Version: 7.60.0 ≤ 7.60.0 Version: 7.59.0 ≤ 7.59.0 Version: 7.58.0 ≤ 7.58.0 Version: 7.57.0 ≤ 7.57.0 Version: 7.56.1 ≤ 7.56.1 Version: 7.56.0 ≤ 7.56.0 Version: 7.55.1 ≤ 7.55.1 Version: 7.55.0 ≤ 7.55.0 Version: 7.54.1 ≤ 7.54.1 Version: 7.54.0 ≤ 7.54.0 Version: 7.53.1 ≤ 7.53.1 Version: 7.53.0 ≤ 7.53.0 Version: 7.52.1 ≤ 7.52.1 Version: 7.52.0 ≤ 7.52.0 Version: 7.51.0 ≤ 7.51.0 Version: 7.50.3 ≤ 7.50.3 Version: 7.50.2 ≤ 7.50.2 Version: 7.50.1 ≤ 7.50.1 Version: 7.50.0 ≤ 7.50.0 Version: 7.49.1 ≤ 7.49.1 Version: 7.49.0 ≤ 7.49.0 Version: 7.48.0 ≤ 7.48.0 Version: 7.47.1 ≤ 7.47.1 Version: 7.47.0 ≤ 7.47.0 Version: 7.46.0 ≤ 7.46.0 Version: 7.45.0 ≤ 7.45.0 Version: 7.44.0 ≤ 7.44.0 Version: 7.43.0 ≤ 7.43.0 Version: 7.42.1 ≤ 7.42.1 Version: 7.42.0 ≤ 7.42.0 Version: 7.41.0 ≤ 7.41.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-11-14T17:02:37.437Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "http://www.openwall.com/lists/oss-security/2024/09/11/1", }, { url: "https://security.netapp.com/advisory/ntap-20241011-0005/", }, { url: "https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:curl:curl:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.9.1", status: "affected", version: "7.41.0", versionType: "semver", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-8096", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-09-11T13:42:47.908850Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-295", description: "CWE-295 Improper Certificate Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-11T13:46:36.676Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.9.1", status: "affected", version: "8.9.1", versionType: "semver", }, { lessThanOrEqual: "8.9.0", status: "affected", version: "8.9.0", versionType: "semver", }, { lessThanOrEqual: "8.8.0", status: "affected", version: "8.8.0", versionType: "semver", }, { lessThanOrEqual: "8.7.1", status: "affected", version: "8.7.1", versionType: "semver", }, { lessThanOrEqual: "8.7.0", status: "affected", version: "8.7.0", versionType: "semver", }, { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, { lessThanOrEqual: "8.5.0", status: "affected", version: "8.5.0", versionType: "semver", }, { lessThanOrEqual: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThanOrEqual: "8.3.0", status: "affected", version: "8.3.0", versionType: "semver", }, { lessThanOrEqual: "8.2.1", status: "affected", version: "8.2.1", versionType: "semver", }, { lessThanOrEqual: "8.2.0", status: "affected", version: "8.2.0", versionType: "semver", }, { lessThanOrEqual: "8.1.2", status: "affected", version: "8.1.2", versionType: "semver", }, { lessThanOrEqual: "8.1.1", status: "affected", version: "8.1.1", versionType: "semver", }, { lessThanOrEqual: "8.1.0", status: "affected", version: "8.1.0", versionType: "semver", }, { lessThanOrEqual: "8.0.1", status: "affected", version: "8.0.1", versionType: "semver", }, { lessThanOrEqual: "8.0.0", status: "affected", version: "8.0.0", versionType: "semver", }, { lessThanOrEqual: "7.88.1", status: "affected", version: "7.88.1", versionType: "semver", }, { lessThanOrEqual: "7.88.0", status: "affected", version: "7.88.0", versionType: "semver", }, { lessThanOrEqual: "7.87.0", status: "affected", version: "7.87.0", versionType: "semver", }, { lessThanOrEqual: "7.86.0", status: "affected", version: "7.86.0", versionType: "semver", }, { lessThanOrEqual: "7.85.0", status: "affected", version: "7.85.0", versionType: "semver", }, { lessThanOrEqual: "7.84.0", status: "affected", version: "7.84.0", versionType: "semver", }, { lessThanOrEqual: "7.83.1", status: "affected", version: "7.83.1", versionType: "semver", }, { lessThanOrEqual: "7.83.0", status: "affected", version: "7.83.0", versionType: "semver", }, { lessThanOrEqual: "7.82.0", status: "affected", version: "7.82.0", versionType: "semver", }, { lessThanOrEqual: "7.81.0", status: "affected", version: "7.81.0", versionType: "semver", }, { lessThanOrEqual: "7.80.0", status: "affected", version: "7.80.0", versionType: "semver", }, { lessThanOrEqual: "7.79.1", status: "affected", version: "7.79.1", versionType: "semver", }, { lessThanOrEqual: "7.79.0", status: "affected", version: "7.79.0", versionType: "semver", }, { lessThanOrEqual: "7.78.0", status: "affected", version: "7.78.0", versionType: "semver", }, { lessThanOrEqual: "7.77.0", status: "affected", version: "7.77.0", versionType: "semver", }, { lessThanOrEqual: "7.76.1", status: "affected", version: "7.76.1", versionType: "semver", }, { lessThanOrEqual: "7.76.0", status: "affected", version: "7.76.0", versionType: "semver", }, { lessThanOrEqual: "7.75.0", status: "affected", version: "7.75.0", versionType: "semver", }, { lessThanOrEqual: "7.74.0", status: "affected", version: "7.74.0", versionType: "semver", }, { lessThanOrEqual: "7.73.0", status: "affected", version: "7.73.0", versionType: "semver", }, { lessThanOrEqual: "7.72.0", status: "affected", version: "7.72.0", versionType: "semver", }, { lessThanOrEqual: "7.71.1", status: "affected", version: "7.71.1", versionType: "semver", }, { lessThanOrEqual: "7.71.0", status: "affected", version: "7.71.0", versionType: "semver", }, { lessThanOrEqual: "7.70.0", status: "affected", version: "7.70.0", versionType: "semver", }, { lessThanOrEqual: "7.69.1", status: "affected", version: "7.69.1", versionType: "semver", }, { lessThanOrEqual: "7.69.0", status: "affected", version: "7.69.0", versionType: "semver", }, { lessThanOrEqual: "7.68.0", status: "affected", version: "7.68.0", versionType: "semver", }, { lessThanOrEqual: "7.67.0", status: "affected", version: "7.67.0", versionType: "semver", }, { lessThanOrEqual: "7.66.0", status: "affected", version: "7.66.0", versionType: "semver", }, { lessThanOrEqual: "7.65.3", status: "affected", version: "7.65.3", versionType: "semver", }, { lessThanOrEqual: "7.65.2", status: "affected", version: "7.65.2", versionType: "semver", }, { lessThanOrEqual: "7.65.1", status: "affected", version: "7.65.1", versionType: "semver", }, { lessThanOrEqual: "7.65.0", status: "affected", version: "7.65.0", versionType: "semver", }, { lessThanOrEqual: "7.64.1", status: "affected", version: "7.64.1", versionType: "semver", }, { lessThanOrEqual: "7.64.0", status: "affected", version: "7.64.0", versionType: "semver", }, { lessThanOrEqual: "7.63.0", status: "affected", version: "7.63.0", versionType: "semver", }, { lessThanOrEqual: "7.62.0", status: "affected", version: "7.62.0", versionType: "semver", }, { lessThanOrEqual: "7.61.1", status: "affected", version: "7.61.1", versionType: "semver", }, { lessThanOrEqual: "7.61.0", status: "affected", version: "7.61.0", versionType: "semver", }, { lessThanOrEqual: "7.60.0", status: "affected", version: "7.60.0", versionType: "semver", }, { lessThanOrEqual: "7.59.0", status: "affected", version: "7.59.0", versionType: "semver", }, { lessThanOrEqual: "7.58.0", status: "affected", version: "7.58.0", versionType: "semver", }, { lessThanOrEqual: "7.57.0", status: "affected", version: "7.57.0", versionType: "semver", }, { lessThanOrEqual: "7.56.1", status: "affected", version: "7.56.1", versionType: "semver", }, { lessThanOrEqual: "7.56.0", status: "affected", version: "7.56.0", versionType: "semver", }, { lessThanOrEqual: "7.55.1", status: "affected", version: "7.55.1", versionType: "semver", }, { lessThanOrEqual: "7.55.0", status: "affected", version: "7.55.0", versionType: "semver", }, { lessThanOrEqual: "7.54.1", status: "affected", version: "7.54.1", versionType: "semver", }, { lessThanOrEqual: "7.54.0", status: "affected", version: "7.54.0", versionType: "semver", }, { lessThanOrEqual: "7.53.1", status: "affected", version: "7.53.1", versionType: "semver", }, { lessThanOrEqual: "7.53.0", status: "affected", version: "7.53.0", versionType: "semver", }, { lessThanOrEqual: "7.52.1", status: "affected", version: "7.52.1", versionType: "semver", }, { lessThanOrEqual: "7.52.0", status: "affected", version: "7.52.0", versionType: "semver", }, { lessThanOrEqual: "7.51.0", status: "affected", version: "7.51.0", versionType: "semver", }, { lessThanOrEqual: "7.50.3", status: "affected", version: "7.50.3", versionType: "semver", }, { lessThanOrEqual: "7.50.2", status: "affected", version: "7.50.2", versionType: "semver", }, { lessThanOrEqual: "7.50.1", status: "affected", version: "7.50.1", versionType: "semver", }, { lessThanOrEqual: "7.50.0", status: "affected", version: "7.50.0", versionType: "semver", }, { lessThanOrEqual: "7.49.1", status: "affected", version: "7.49.1", versionType: "semver", }, { lessThanOrEqual: "7.49.0", status: "affected", version: "7.49.0", versionType: "semver", }, { lessThanOrEqual: "7.48.0", status: "affected", version: "7.48.0", versionType: "semver", }, { lessThanOrEqual: "7.47.1", status: "affected", version: "7.47.1", versionType: "semver", }, { lessThanOrEqual: "7.47.0", status: "affected", version: "7.47.0", versionType: "semver", }, { lessThanOrEqual: "7.46.0", status: "affected", version: "7.46.0", versionType: "semver", }, { lessThanOrEqual: "7.45.0", status: "affected", version: "7.45.0", versionType: "semver", }, { lessThanOrEqual: "7.44.0", status: "affected", version: "7.44.0", versionType: "semver", }, { lessThanOrEqual: "7.43.0", status: "affected", version: "7.43.0", versionType: "semver", }, { lessThanOrEqual: "7.42.1", status: "affected", version: "7.42.1", versionType: "semver", }, { lessThanOrEqual: "7.42.0", status: "affected", version: "7.42.0", versionType: "semver", }, { lessThanOrEqual: "7.41.0", status: "affected", version: "7.41.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Hiroki Kurosawa", }, { lang: "en", type: "remediation developer", value: "Daniel Stenberg", }, ], descriptions: [ { lang: "en", value: "When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-295 Improper Certificate Validation", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-11T10:03:59.489Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-8096.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-8096.html", }, { name: "issue", url: "https://hackerone.com/reports/2669852", }, ], title: "OCSP stapling bypass with GnuTLS", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-8096", datePublished: "2024-09-11T10:03:59.489Z", dateReserved: "2024-08-22T14:46:26.822Z", dateUpdated: "2024-11-14T17:02:37.437Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2019-5435
Vulnerability from cvelistv5
Published
2019-05-28 18:44
Modified
2024-08-04 19:54
Severity ?
EPSS score ?
Summary
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
References
| ▼ | URL | Tags |
|---|---|---|
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/ | vendor-advisory, x_refsource_FEDORA | |
| https://security.gentoo.org/glsa/202003-29 | vendor-advisory, x_refsource_GENTOO | |
| https://www.oracle.com/security-alerts/cpuapr2020.html | x_refsource_MISC | |
| https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html | x_refsource_MISC | |
| https://www.oracle.com/security-alerts/cpuoct2020.html | x_refsource_MISC | |
| https://curl.haxx.se/docs/CVE-2019-5435.html | x_refsource_CONFIRM | |
| https://security.netapp.com/advisory/ntap-20190606-0004/ | x_refsource_CONFIRM | |
| https://support.f5.com/csp/article/K08125515 | x_refsource_CONFIRM |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T19:54:53.476Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "FEDORA-2019-697de0501f", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/", }, { name: "GLSA-202003-29", tags: [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred", ], url: "https://security.gentoo.org/glsa/202003-29", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://curl.haxx.se/docs/CVE-2019-5435.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20190606-0004/", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://support.f5.com/csp/article/K08125515", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "curl", vendor: "curl", versions: [ { status: "affected", version: "Fixed in 7.65.0", }, ], }, ], datePublic: "2019-05-22T00:00:00", descriptions: [ { lang: "en", value: "An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-131", description: "Incorrect Calculation of Buffer Size (CWE-131)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2020-10-20T21:15:00", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { name: "FEDORA-2019-697de0501f", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/", }, { name: "GLSA-202003-29", tags: [ "vendor-advisory", "x_refsource_GENTOO", ], url: "https://security.gentoo.org/glsa/202003-29", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://curl.haxx.se/docs/CVE-2019-5435.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://security.netapp.com/advisory/ntap-20190606-0004/", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://support.f5.com/csp/article/K08125515", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "support@hackerone.com", ID: "CVE-2019-5435", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "curl", version: { version_data: [ { version_value: "Fixed in 7.65.0", }, ], }, }, ], }, vendor_name: "curl", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Incorrect Calculation of Buffer Size (CWE-131)", }, ], }, ], }, references: { reference_data: [ { name: "FEDORA-2019-697de0501f", refsource: "FEDORA", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/", }, { name: "GLSA-202003-29", refsource: "GENTOO", url: "https://security.gentoo.org/glsa/202003-29", }, { name: "https://www.oracle.com/security-alerts/cpuapr2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { name: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", refsource: "MISC", url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { name: "https://www.oracle.com/security-alerts/cpuoct2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { name: "https://curl.haxx.se/docs/CVE-2019-5435.html", refsource: "CONFIRM", url: "https://curl.haxx.se/docs/CVE-2019-5435.html", }, { name: "https://security.netapp.com/advisory/ntap-20190606-0004/", refsource: "CONFIRM", url: "https://security.netapp.com/advisory/ntap-20190606-0004/", }, { name: "https://support.f5.com/csp/article/K08125515", refsource: "CONFIRM", url: "https://support.f5.com/csp/article/K08125515", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2019-5435", datePublished: "2019-05-28T18:44:01", dateReserved: "2019-01-04T00:00:00", dateUpdated: "2024-08-04T19:54:53.476Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2005-0490
Vulnerability from cvelistv5
Published
2005-02-21 05:00
Modified
2024-08-07 21:13
Severity ?
EPSS score ?
Summary
Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T21:13:54.367Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "20050228 [USN-86-1] cURL vulnerability", tags: [ "mailing-list", "x_refsource_FULLDISC", "x_transferred", ], url: "http://marc.info/?l=full-disclosure&m=110959085507755&w=2", }, { name: "CLA-2005:940", tags: [ "vendor-advisory", "x_refsource_CONECTIVA", "x_transferred", ], url: "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940", }, { name: "20050221 Multiple Unix/Linux Vendor cURL/libcURL NTLM Authentication Buffer Overflow Vulnerability", tags: [ "third-party-advisory", "x_refsource_IDEFENSE", "x_transferred", ], url: "http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities", }, { name: "oval:org.mitre.oval:def:10273", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10273", }, { name: "12616", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/12616", }, { name: "12615", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/12615", }, { name: "curl-kerberos-bo(19423)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/19423", }, { name: "20050221 Multiple Unix/Linux Vendor cURL/libcURL Kerberos Authentication Buffer Overflow Vulnerability", tags: [ "third-party-advisory", "x_refsource_IDEFENSE", "x_transferred", ], url: "http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities", }, { name: "MDKSA-2005:048", tags: [ "vendor-advisory", "x_refsource_MANDRAKE", "x_transferred", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:048", }, { name: "GLSA-200503-20", tags: [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred", ], url: "http://www.gentoo.org/security/en/glsa/glsa-200503-20.xml", }, { name: "RHSA-2005:340", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2005-340.html", }, { name: "SUSE-SA:2005:011", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://www.novell.com/linux/security/advisories/2005_11_curl.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2005-02-21T00:00:00", descriptions: [ { lang: "en", value: "Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-10-10T00:57:01", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "20050228 [USN-86-1] cURL vulnerability", tags: [ "mailing-list", "x_refsource_FULLDISC", ], url: "http://marc.info/?l=full-disclosure&m=110959085507755&w=2", }, { name: "CLA-2005:940", tags: [ "vendor-advisory", "x_refsource_CONECTIVA", ], url: "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940", }, { name: "20050221 Multiple Unix/Linux Vendor cURL/libcURL NTLM Authentication Buffer Overflow Vulnerability", tags: [ "third-party-advisory", "x_refsource_IDEFENSE", ], url: "http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities", }, { name: "oval:org.mitre.oval:def:10273", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10273", }, { name: "12616", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/12616", }, { name: "12615", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/12615", }, { name: "curl-kerberos-bo(19423)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/19423", }, { name: "20050221 Multiple Unix/Linux Vendor cURL/libcURL Kerberos Authentication Buffer Overflow Vulnerability", tags: [ "third-party-advisory", "x_refsource_IDEFENSE", ], url: "http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities", }, { name: "MDKSA-2005:048", tags: [ "vendor-advisory", "x_refsource_MANDRAKE", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:048", }, { name: "GLSA-200503-20", tags: [ "vendor-advisory", "x_refsource_GENTOO", ], url: "http://www.gentoo.org/security/en/glsa/glsa-200503-20.xml", }, { name: "RHSA-2005:340", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2005-340.html", }, { name: "SUSE-SA:2005:011", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://www.novell.com/linux/security/advisories/2005_11_curl.html", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2005-0490", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "20050228 [USN-86-1] cURL vulnerability", refsource: "FULLDISC", url: "http://marc.info/?l=full-disclosure&m=110959085507755&w=2", }, { name: "CLA-2005:940", refsource: "CONECTIVA", url: "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940", }, { name: "20050221 Multiple Unix/Linux Vendor cURL/libcURL NTLM Authentication Buffer Overflow Vulnerability", refsource: "IDEFENSE", url: "http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities", }, { name: "oval:org.mitre.oval:def:10273", refsource: "OVAL", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10273", }, { name: "12616", refsource: "BID", url: "http://www.securityfocus.com/bid/12616", }, { name: "12615", refsource: "BID", url: "http://www.securityfocus.com/bid/12615", }, { name: "curl-kerberos-bo(19423)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/19423", }, { name: "20050221 Multiple Unix/Linux Vendor cURL/libcURL Kerberos Authentication Buffer Overflow Vulnerability", refsource: "IDEFENSE", url: "http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities", }, { name: "MDKSA-2005:048", refsource: "MANDRAKE", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:048", }, { name: "GLSA-200503-20", refsource: "GENTOO", url: "http://www.gentoo.org/security/en/glsa/glsa-200503-20.xml", }, { name: "RHSA-2005:340", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2005-340.html", }, { name: "SUSE-SA:2005:011", refsource: "SUSE", url: "http://www.novell.com/linux/security/advisories/2005_11_curl.html", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2005-0490", datePublished: "2005-02-21T05:00:00", dateReserved: "2005-02-21T00:00:00", dateUpdated: "2024-08-07T21:13:54.367Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-0853
Vulnerability from cvelistv5
Published
2024-02-03 13:35
Modified
2025-02-13 17:27
Severity ?
EPSS score ?
Summary
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to
the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-01T18:18:19.012Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "json", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-0853.json", }, { name: "www", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-0853.html", }, { name: "issue", tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2298922", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240307-0004/", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240426-0009/", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240503-0012/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.5.0", status: "affected", version: "8.5.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Hiroki Kurosawa", }, { lang: "en", type: "remediation developer", value: "Daniel Stenberg", }, ], descriptions: [ { lang: "en", value: "curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-299 Improper Check for Certificate Revocation", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-05-03T13:06:05.485Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-0853.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-0853.html", }, { name: "issue", url: "https://hackerone.com/reports/2298922", }, { url: "https://security.netapp.com/advisory/ntap-20240307-0004/", }, { url: "https://security.netapp.com/advisory/ntap-20240426-0009/", }, { url: "https://security.netapp.com/advisory/ntap-20240503-0012/", }, ], title: "OCSP verification bypass with TLS session reuse", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-0853", datePublished: "2024-02-03T13:35:25.863Z", dateReserved: "2024-01-24T08:42:02.618Z", dateUpdated: "2025-02-13T17:27:29.501Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-0167
Vulnerability from cvelistv5
Published
2025-02-05 09:15
Modified
2025-03-07 00:10
Severity ?
EPSS score ?
Summary
When asked to use a `.netrc` file for credentials **and** to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has a `default` entry that
omits both login and password. A rare circumstance.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| curl | curl |
Version: 8.11.1 ≤ 8.11.1 Version: 8.11.0 ≤ 8.11.0 Version: 8.10.1 ≤ 8.10.1 Version: 8.10.0 ≤ 8.10.0 Version: 8.9.1 ≤ 8.9.1 Version: 8.9.0 ≤ 8.9.0 Version: 8.8.0 ≤ 8.8.0 Version: 8.7.1 ≤ 8.7.1 Version: 8.7.0 ≤ 8.7.0 Version: 8.6.0 ≤ 8.6.0 Version: 8.5.0 ≤ 8.5.0 Version: 8.4.0 ≤ 8.4.0 Version: 8.3.0 ≤ 8.3.0 Version: 8.2.1 ≤ 8.2.1 Version: 8.2.0 ≤ 8.2.0 Version: 8.1.2 ≤ 8.1.2 Version: 8.1.1 ≤ 8.1.1 Version: 8.1.0 ≤ 8.1.0 Version: 8.0.1 ≤ 8.0.1 Version: 8.0.0 ≤ 8.0.0 Version: 7.88.1 ≤ 7.88.1 Version: 7.88.0 ≤ 7.88.0 Version: 7.87.0 ≤ 7.87.0 Version: 7.86.0 ≤ 7.86.0 Version: 7.85.0 ≤ 7.85.0 Version: 7.84.0 ≤ 7.84.0 Version: 7.83.1 ≤ 7.83.1 Version: 7.83.0 ≤ 7.83.0 Version: 7.82.0 ≤ 7.82.0 Version: 7.81.0 ≤ 7.81.0 Version: 7.80.0 ≤ 7.80.0 Version: 7.79.1 ≤ 7.79.1 Version: 7.79.0 ≤ 7.79.0 Version: 7.78.0 ≤ 7.78.0 Version: 7.77.0 ≤ 7.77.0 Version: 7.76.1 ≤ 7.76.1 Version: 7.76.0 ≤ 7.76.0 |
{ containers: { adp: [ { metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.4, baseSeverity: "LOW", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2025-0167", options: [ { Exploitation: "poc", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-02-05T15:52:41.551530Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2025-02-06T14:48:00.488Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, references: [ { tags: [ "exploit", ], url: "https://curl.se/docs/CVE-2025-0167.html", }, ], title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2025-03-07T00:10:48.290Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "https://security.netapp.com/advisory/ntap-20250306-0008/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.11.1", status: "affected", version: "8.11.1", versionType: "semver", }, { lessThanOrEqual: "8.11.0", status: "affected", version: "8.11.0", versionType: "semver", }, { lessThanOrEqual: "8.10.1", status: "affected", version: "8.10.1", versionType: "semver", }, { lessThanOrEqual: "8.10.0", status: "affected", version: "8.10.0", versionType: "semver", }, { lessThanOrEqual: "8.9.1", status: "affected", version: "8.9.1", versionType: "semver", }, { lessThanOrEqual: "8.9.0", status: "affected", version: "8.9.0", versionType: "semver", }, { lessThanOrEqual: "8.8.0", status: "affected", version: "8.8.0", versionType: "semver", }, { lessThanOrEqual: "8.7.1", status: "affected", version: "8.7.1", versionType: "semver", }, { lessThanOrEqual: "8.7.0", status: "affected", version: "8.7.0", versionType: "semver", }, { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, { lessThanOrEqual: "8.5.0", status: "affected", version: "8.5.0", versionType: "semver", }, { lessThanOrEqual: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThanOrEqual: "8.3.0", status: "affected", version: "8.3.0", versionType: "semver", }, { lessThanOrEqual: "8.2.1", status: "affected", version: "8.2.1", versionType: "semver", }, { lessThanOrEqual: "8.2.0", status: "affected", version: "8.2.0", versionType: "semver", }, { lessThanOrEqual: "8.1.2", status: "affected", version: "8.1.2", versionType: "semver", }, { lessThanOrEqual: "8.1.1", status: "affected", version: "8.1.1", versionType: "semver", }, { lessThanOrEqual: "8.1.0", status: "affected", version: "8.1.0", versionType: "semver", }, { lessThanOrEqual: "8.0.1", status: "affected", version: "8.0.1", versionType: "semver", }, { lessThanOrEqual: "8.0.0", status: "affected", version: "8.0.0", versionType: "semver", }, { lessThanOrEqual: "7.88.1", status: "affected", version: "7.88.1", versionType: "semver", }, { lessThanOrEqual: "7.88.0", status: "affected", version: "7.88.0", versionType: "semver", }, { lessThanOrEqual: "7.87.0", status: "affected", version: "7.87.0", versionType: "semver", }, { lessThanOrEqual: "7.86.0", status: "affected", version: "7.86.0", versionType: "semver", }, { lessThanOrEqual: "7.85.0", status: "affected", version: "7.85.0", versionType: "semver", }, { lessThanOrEqual: "7.84.0", status: "affected", version: "7.84.0", versionType: "semver", }, { lessThanOrEqual: "7.83.1", status: "affected", version: "7.83.1", versionType: "semver", }, { lessThanOrEqual: "7.83.0", status: "affected", version: "7.83.0", versionType: "semver", }, { lessThanOrEqual: "7.82.0", status: "affected", version: "7.82.0", versionType: "semver", }, { lessThanOrEqual: "7.81.0", status: "affected", version: "7.81.0", versionType: "semver", }, { lessThanOrEqual: "7.80.0", status: "affected", version: "7.80.0", versionType: "semver", }, { lessThanOrEqual: "7.79.1", status: "affected", version: "7.79.1", versionType: "semver", }, { lessThanOrEqual: "7.79.0", status: "affected", version: "7.79.0", versionType: "semver", }, { lessThanOrEqual: "7.78.0", status: "affected", version: "7.78.0", versionType: "semver", }, { lessThanOrEqual: "7.77.0", status: "affected", version: "7.77.0", versionType: "semver", }, { lessThanOrEqual: "7.76.1", status: "affected", version: "7.76.1", versionType: "semver", }, { lessThanOrEqual: "7.76.0", status: "affected", version: "7.76.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Yihang Zhou", }, { lang: "en", type: "remediation developer", value: "Daniel Stenberg", }, ], descriptions: [ { lang: "en", value: "When asked to use a `.netrc` file for credentials **and** to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has a `default` entry that\nomits both login and password. A rare circumstance.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-05T09:15:06.891Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2025-0167.json", }, { name: "www", url: "https://curl.se/docs/CVE-2025-0167.html", }, { name: "issue", url: "https://hackerone.com/reports/2917232", }, ], title: "netrc and default credential leak", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2025-0167", datePublished: "2025-02-05T09:15:06.891Z", dateReserved: "2024-12-31T23:07:29.650Z", dateUpdated: "2025-03-07T00:10:48.290Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2012-0036
Vulnerability from cvelistv5
Published
2012-04-13 20:00
Modified
2024-08-06 18:09
Severity ?
EPSS score ?
Summary
curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-06T18:09:17.303Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html", }, { name: "HPSBMU02786", tags: [ "vendor-advisory", "x_refsource_HP", "x_transferred", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03760en_us", }, { name: "1032924", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://www.securitytracker.com/id/1032924", }, { name: "DSA-2398", tags: [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred", ], url: "http://www.debian.org/security/2012/dsa-2398", }, { name: "GLSA-201203-02", tags: [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred", ], url: "http://security.gentoo.org/glsa/glsa-201203-02.xml", }, { name: "51665", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/51665", }, { name: "48256", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/48256", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://curl.haxx.se/docs/adv_20120124.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://curl.haxx.se/curl-url-sanitize.patch", }, { name: "MDVSA-2012:058", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", "x_transferred", ], url: "http://www.mandriva.com/security/advisories?name=MDVSA-2012:058", }, { name: "SSRT100877", tags: [ "vendor-advisory", "x_refsource_HP", "x_transferred", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=773457", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://support.apple.com/kb/HT5281", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://github.com/bagder/curl/commit/75ca568fa1c19de4c5358fed246686de8467c238", }, { name: "APPLE-SA-2012-05-09-1", tags: [ "vendor-advisory", "x_refsource_APPLE", "x_transferred", ], url: "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2012-01-24T00:00:00", descriptions: [ { lang: "en", value: "curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-01-09T17:57:01", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html", }, { name: "HPSBMU02786", tags: [ "vendor-advisory", "x_refsource_HP", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03760en_us", }, { name: "1032924", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://www.securitytracker.com/id/1032924", }, { name: "DSA-2398", tags: [ "vendor-advisory", "x_refsource_DEBIAN", ], url: "http://www.debian.org/security/2012/dsa-2398", }, { name: "GLSA-201203-02", tags: [ "vendor-advisory", "x_refsource_GENTOO", ], url: "http://security.gentoo.org/glsa/glsa-201203-02.xml", }, { name: "51665", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/51665", }, { name: "48256", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/48256", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://curl.haxx.se/docs/adv_20120124.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://curl.haxx.se/curl-url-sanitize.patch", }, { name: "MDVSA-2012:058", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", ], url: "http://www.mandriva.com/security/advisories?name=MDVSA-2012:058", }, { name: "SSRT100877", tags: [ "vendor-advisory", "x_refsource_HP", ], url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=773457", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://support.apple.com/kb/HT5281", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://github.com/bagder/curl/commit/75ca568fa1c19de4c5358fed246686de8467c238", }, { name: "APPLE-SA-2012-05-09-1", tags: [ "vendor-advisory", "x_refsource_APPLE", ], url: "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html", }, ], }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2012-0036", datePublished: "2012-04-13T20:00:00", dateReserved: "2011-12-07T00:00:00", dateUpdated: "2024-08-06T18:09:17.303Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-2004
Vulnerability from cvelistv5
Published
2024-03-27 07:54
Modified
2025-02-13 17:32
Severity ?
EPSS score ?
Summary
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| curl | curl |
Version: 8.6.0 ≤ 8.6.0 Version: 8.5.0 ≤ 8.5.0 Version: 8.4.0 ≤ 8.4.0 Version: 8.3.0 ≤ 8.3.0 Version: 8.2.1 ≤ 8.2.1 Version: 8.2.0 ≤ 8.2.0 Version: 8.1.2 ≤ 8.1.2 Version: 8.1.1 ≤ 8.1.1 Version: 8.1.0 ≤ 8.1.0 Version: 8.0.1 ≤ 8.0.1 Version: 8.0.0 ≤ 8.0.0 Version: 7.88.1 ≤ 7.88.1 Version: 7.88.0 ≤ 7.88.0 Version: 7.87.0 ≤ 7.87.0 Version: 7.86.0 ≤ 7.86.0 Version: 7.85.0 ≤ 7.85.0 |
{ containers: { adp: [ { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.5, baseSeverity: "LOW", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-2004", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-04-25T18:17:42.513804Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-436", description: "CWE-436 Interpretation Conflict", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-10-29T16:07:41.015Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-01T18:56:22.517Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "json", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-2004.json", }, { name: "www", tags: [ "x_transferred", ], url: "https://curl.se/docs/CVE-2024-2004.html", }, { name: "issue", tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2384833", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/03/27/1", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240524-0006/", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214119", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214118", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214120", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/20", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/18", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/19", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "curl", vendor: "curl", versions: [ { lessThanOrEqual: "8.6.0", status: "affected", version: "8.6.0", versionType: "semver", }, { lessThanOrEqual: "8.5.0", status: "affected", version: "8.5.0", versionType: "semver", }, { lessThanOrEqual: "8.4.0", status: "affected", version: "8.4.0", versionType: "semver", }, { lessThanOrEqual: "8.3.0", status: "affected", version: "8.3.0", versionType: "semver", }, { lessThanOrEqual: "8.2.1", status: "affected", version: "8.2.1", versionType: "semver", }, { lessThanOrEqual: "8.2.0", status: "affected", version: "8.2.0", versionType: "semver", }, { lessThanOrEqual: "8.1.2", status: "affected", version: "8.1.2", versionType: "semver", }, { lessThanOrEqual: "8.1.1", status: "affected", version: "8.1.1", versionType: "semver", }, { lessThanOrEqual: "8.1.0", status: "affected", version: "8.1.0", versionType: "semver", }, { lessThanOrEqual: "8.0.1", status: "affected", version: "8.0.1", versionType: "semver", }, { lessThanOrEqual: "8.0.0", status: "affected", version: "8.0.0", versionType: "semver", }, { lessThanOrEqual: "7.88.1", status: "affected", version: "7.88.1", versionType: "semver", }, { lessThanOrEqual: "7.88.0", status: "affected", version: "7.88.0", versionType: "semver", }, { lessThanOrEqual: "7.87.0", status: "affected", version: "7.87.0", versionType: "semver", }, { lessThanOrEqual: "7.86.0", status: "affected", version: "7.86.0", versionType: "semver", }, { lessThanOrEqual: "7.85.0", status: "affected", version: "7.85.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Dan Fandrich", }, { lang: "en", type: "remediation developer", value: "Daniel Gustafsson", }, ], descriptions: [ { lang: "en", value: "When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-115 Misinterpretation of Input", lang: "en", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-29T22:06:25.581Z", orgId: "2499f714-1537-4658-8207-48ae4bb9eae9", shortName: "curl", }, references: [ { name: "json", url: "https://curl.se/docs/CVE-2024-2004.json", }, { name: "www", url: "https://curl.se/docs/CVE-2024-2004.html", }, { name: "issue", url: "https://hackerone.com/reports/2384833", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/", }, { url: "http://www.openwall.com/lists/oss-security/2024/03/27/1", }, { url: "https://security.netapp.com/advisory/ntap-20240524-0006/", }, { url: "https://support.apple.com/kb/HT214119", }, { url: "https://support.apple.com/kb/HT214118", }, { url: "https://support.apple.com/kb/HT214120", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/20", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/18", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/19", }, ], title: "Usage of disabled protocol", }, }, cveMetadata: { assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9", assignerShortName: "curl", cveId: "CVE-2024-2004", datePublished: "2024-03-27T07:54:27.157Z", dateReserved: "2024-02-29T11:05:48.981Z", dateUpdated: "2025-02-13T17:32:29.487Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-52071
Vulnerability from cvelistv5
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Show details on NVD website{ containers: { cna: { providerMetadata: { dateUpdated: "2024-02-23T08:12:51.640297", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, rejectedReasons: [ { lang: "en", value: "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2023-52071", dateRejected: "2024-02-23T00:00:00", dateReserved: "2023-12-26T00:00:00", dateUpdated: "2024-02-23T08:12:51.640297", state: "REJECTED", }, dataType: "CVE_RECORD", dataVersion: "5.0", }
cve-2010-3842
Vulnerability from cvelistv5
Published
2010-10-27 22:00
Modified
2024-08-07 03:26
Severity ?
EPSS score ?
Summary
Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ (backslash) as a separator of path components within the Content-disposition HTTP header.
References
| ▼ | URL | Tags |
|---|---|---|
| http://curl.haxx.se/docs/adv_20101013.html | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2010/10/13/4 | mailing-list, x_refsource_MLIST | |
| http://www.openwall.com/lists/oss-security/2010/10/13/5 | mailing-list, x_refsource_MLIST | |
| http://securitytracker.com/id?1024583 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/39532 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.openwall.com/lists/oss-security/2010/10/13/1 | mailing-list, x_refsource_MLIST | |
| https://bugzilla.redhat.com/show_bug.cgi?id=642642 | x_refsource_CONFIRM |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T03:26:12.269Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://curl.haxx.se/docs/adv_20101013.html", }, { name: "[oss-security] 20101013 Re: CVE Request -- cURL / mingw32-cURL -- Did not strip directory parts separated by backslashes, when downloading files", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2010/10/13/4", }, { name: "[oss-security] 20101013 Re: CVE Request -- cURL / mingw32-cURL -- Did not strip directory parts separated by backslashes, when downloading files", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2010/10/13/5", }, { name: "1024583", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://securitytracker.com/id?1024583", }, { name: "39532", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/39532", }, { name: "[oss-security] 20101013 CVE Request -- cURL / mingw32-cURL -- Did not strip directory parts separated by backslashes, when downloading files", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2010/10/13/1", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=642642", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \\ (backslash) as a separator of path components within the Content-disposition HTTP header.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2010-10-27T22:00:00Z", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "http://curl.haxx.se/docs/adv_20101013.html", }, { name: "[oss-security] 20101013 Re: CVE Request -- cURL / mingw32-cURL -- Did not strip directory parts separated by backslashes, when downloading files", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://www.openwall.com/lists/oss-security/2010/10/13/4", }, { name: "[oss-security] 20101013 Re: CVE Request -- cURL / mingw32-cURL -- Did not strip directory parts separated by backslashes, when downloading files", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://www.openwall.com/lists/oss-security/2010/10/13/5", }, { name: "1024583", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://securitytracker.com/id?1024583", }, { name: "39532", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/39532", }, { name: "[oss-security] 20101013 CVE Request -- cURL / mingw32-cURL -- Did not strip directory parts separated by backslashes, when downloading files", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://www.openwall.com/lists/oss-security/2010/10/13/1", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=642642", }, ], }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2010-3842", datePublished: "2010-10-27T22:00:00Z", dateReserved: "2010-10-08T00:00:00Z", dateUpdated: "2024-08-07T03:26:12.269Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Vulnerability from fkie_nvd
Published
2009-03-05 02:30
Modified
2024-11-21 00:58
Severity ?
Summary
The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:curl:curl:5.11:*:*:*:*:*:*:*", matchCriteriaId: "547AF432-EC84-4D3F-9A1A-9DDDE90FAA89", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:6.0:*:*:*:*:*:*:*", matchCriteriaId: "716A8128-1159-4E38-A35B-DB011915145B", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:6.1beta:*:*:*:*:*:*:*", matchCriteriaId: "21D0B74A-8656-486A-97D8-0FFA2B6E7577", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:6.2:*:*:*:*:*:*:*", matchCriteriaId: "CCFF7F97-FA48-43BF-BF90-180B9E9099AB", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:6.3:*:*:*:*:*:*:*", matchCriteriaId: "48753D9B-72A1-4F7C-A71E-AA502F5FA6AB", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:6.3.1:*:*:*:*:*:*:*", matchCriteriaId: "2F7F9940-212B-4AA8-B42F-6A8DDBA27652", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:6.4:*:*:*:*:*:*:*", matchCriteriaId: "8F9238EF-73A5-486E-94BD-3A411DFBE419", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:6.5:*:*:*:*:*:*:*", matchCriteriaId: "8FF49459-9F8D-4BF5-9F24-DCB256A72FCA", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:6.5.1:*:*:*:*:*:*:*", matchCriteriaId: "CA5A191C-D5AE-4A22-8D1A-38FBF5C24705", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:6.5.2:*:*:*:*:*:*:*", matchCriteriaId: "E7637717-CF5F-4AA4-9433-5C80C711D824", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.1:*:*:*:*:*:*:*", matchCriteriaId: "3AC0FFDE-B7C6-47AD-8BED-181E10268643", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.1.1:*:*:*:*:*:*:*", matchCriteriaId: "DAAA0E96-283D-4590-BE3C-76D0A222EB06", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.2:*:*:*:*:*:*:*", matchCriteriaId: "74325BB1-54AE-40BC-81C0-AD07CE6BBDCC", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.2.1:*:*:*:*:*:*:*", matchCriteriaId: "1A980CED-EB95-4997-BE4C-56EF96A14471", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.3:*:*:*:*:*:*:*", matchCriteriaId: "A8D83D9F-242B-4689-91EF-64A56C769C36", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.4:*:*:*:*:*:*:*", matchCriteriaId: "17FA67F8-137F-4778-A6B6-A6EF59C2271B", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.4.1:*:*:*:*:*:*:*", matchCriteriaId: "49F84D43-1CE6-452D-A819-44C7CCBCB8C6", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.4.2:*:*:*:*:*:*:*", matchCriteriaId: "95EE97A0-420F-4FB7-89CF-2E8064D7E0B9", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.5:*:*:*:*:*:*:*", matchCriteriaId: "9DE2E637-D0CA-4B2E-8386-EF2892E5E074", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.5.1:*:*:*:*:*:*:*", matchCriteriaId: "2A6DC7AC-CF08-4E45-AA75-2BABF59D960B", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.5.2:*:*:*:*:*:*:*", matchCriteriaId: "7CB3A5AE-F854-483C-A6DA-02F811F2F6B9", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.6:*:*:*:*:*:*:*", matchCriteriaId: "D20FA870-2B29-4CFE-ABD1-62DB4E165B41", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.6.1:*:*:*:*:*:*:*", matchCriteriaId: "8019F384-E7EA-4E4D-8E09-4A1FDDB3849B", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.7:*:*:*:*:*:*:*", matchCriteriaId: "37105953-D573-4191-BB96-758F6AFD882C", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.7.1:*:*:*:*:*:*:*", matchCriteriaId: "35898A38-91F6-4C77-ACFD-70E1380AEF35", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.7.2:*:*:*:*:*:*:*", matchCriteriaId: "6E3545C6-934D-4C55-B285-DB44783E0907", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.7.3:*:*:*:*:*:*:*", matchCriteriaId: "7F5AC6F4-443D-4EB6-83E7-4F193BCC1D0F", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.8:*:*:*:*:*:*:*", matchCriteriaId: "2BC29408-D7CE-496B-AB2C-783EE40BCC5B", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.8.1:*:*:*:*:*:*:*", matchCriteriaId: "DEC171D9-5418-4C66-BBDA-ABFD978CF113", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.8.2:*:*:*:*:*:*:*", matchCriteriaId: "3CD68B6D-72AB-4A61-9528-8631B147A3DF", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.9:*:*:*:*:*:*:*", matchCriteriaId: "97233341-471B-4B59-95ED-F376460370AD", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.9.1:*:*:*:*:*:*:*", matchCriteriaId: "A0080682-F304-45BE-A13B-C75C48245E49", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.9.2:*:*:*:*:*:*:*", matchCriteriaId: "46D90019-9713-46CB-90F5-CF6F016AE1D6", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.9.3:*:*:*:*:*:*:*", matchCriteriaId: "FE6D2C32-ADA4-4859-A30F-7B910D96F02A", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.9.4:*:*:*:*:*:*:*", matchCriteriaId: "7CDA26B4-A6F6-41B4-A592-C9AF101C5A33", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.9.5:*:*:*:*:*:*:*", matchCriteriaId: "87392CA8-DA66-4E55-9EDA-A85DC6AA253A", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.9.6:*:*:*:*:*:*:*", matchCriteriaId: "DFFBF583-CE6A-4670-B196-3EEA7B4389BD", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.9.7:*:*:*:*:*:*:*", matchCriteriaId: "75DFDCF3-FBC3-4231-9915-2D4A7853C1E7", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.9.8:*:*:*:*:*:*:*", matchCriteriaId: "D2669757-AA52-4C71-96E4-8A32883574D7", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.10:*:*:*:*:*:*:*", matchCriteriaId: "8777B0FB-8BFB-4D98-A4C2-E60807CF0C5E", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.10.1:*:*:*:*:*:*:*", matchCriteriaId: "19C0BD35-0B32-46B8-A442-2FEA4762523F", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.10.2:*:*:*:*:*:*:*", matchCriteriaId: "8A9FFE5B-34E9-47FF-975C-ADC315E7C1E5", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.10.3:*:*:*:*:*:*:*", matchCriteriaId: "E262EDF2-E490-48F1-B277-844C14CD7361", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.10.4:*:*:*:*:*:*:*", matchCriteriaId: "D1B1C3BA-BAC3-4424-9523-BCDC373E8EC7", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.10.5:*:*:*:*:*:*:*", matchCriteriaId: "96B0B2AA-4FD6-4376-A239-00E9431C9F7F", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.10.6:*:*:*:*:*:*:*", matchCriteriaId: "21A11159-1757-404E-AA07-DD865DCDEF8E", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.10.7:*:*:*:*:*:*:*", matchCriteriaId: "7E300177-087D-4103-9092-FF6A4052EA30", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.10.8:*:*:*:*:*:*:*", matchCriteriaId: "2D5D1EA8-D015-49F2-B134-C665969F0276", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.11.1:*:*:*:*:*:*:*", matchCriteriaId: "1CC24D6B-E3E4-4C07-9C4E-3748FDE300EB", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.12:*:*:*:*:*:*:*", matchCriteriaId: "FAE6AD55-E3D2-46FD-8EFF-595EEF3B6F0E", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.12.1:*:*:*:*:*:*:*", matchCriteriaId: "4848C3C8-432D-43E7-B0D9-8FD69D4C3B0F", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.12.2:*:*:*:*:*:*:*", matchCriteriaId: "A0A7BE71-D4FB-42FF-8ED4-BA5A81BE8720", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.13:*:*:*:*:*:*:*", matchCriteriaId: "D020D95D-CD04-48A5-9488-1C6E7F69ED8C", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.13.2:*:*:*:*:*:*:*", matchCriteriaId: "B2458D0E-66F7-484C-9989-308530AE766D", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.14:*:*:*:*:*:*:*", matchCriteriaId: "80B2D97A-083B-4DEB-A02E-124F36838130", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.14.1:*:*:*:*:*:*:*", matchCriteriaId: "EAF7D32E-D07A-478E-96E7-0302B6118B3A", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.15:*:*:*:*:*:*:*", matchCriteriaId: "3D46E759-3E26-41AC-BF71-A0450CBF54FB", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.15.1:*:*:*:*:*:*:*", matchCriteriaId: "61CA2263-4478-477A-86C4-6CCCC36F3EBD", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.15.3:*:*:*:*:*:*:*", matchCriteriaId: "B0401FA1-CF19-4BBA-B61B-263CFBA92B71", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.16.3:*:*:*:*:*:*:*", matchCriteriaId: "3A28049D-C8AF-42D0-A294-851854A66516", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.16.4:*:*:*:*:*:*:*", matchCriteriaId: "F19EC641-0BC7-486B-A7B7-2C0264BC2DAB", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.17:*:*:*:*:*:*:*", matchCriteriaId: "24C045C9-332E-4277-9167-F25D7F62F702", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.18:*:*:*:*:*:*:*", matchCriteriaId: "262827E1-A139-46E2-B44D-46CC40E8E33B", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.19.3:*:*:*:*:*:*:*", matchCriteriaId: "67B81B43-895A-4FD4-A274-CA762C73DCA6", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:5.11:*:*:*:*:*:*:*", matchCriteriaId: "339F2D11-27F1-42A8-A780-8D0DAFB168C2", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.12:*:*:*:*:*:*:*", matchCriteriaId: "3DEC85E8-5555-46A9-9A95-30E1497AFA09", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.12.1:*:*:*:*:*:*:*", matchCriteriaId: "03060364-7DCD-4111-BF7A-BEF6AFCB3134", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.12.2:*:*:*:*:*:*:*", matchCriteriaId: "319DADFB-081B-46AA-9F7D-DD4D1C5BE26D", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.12.3:*:*:*:*:*:*:*", matchCriteriaId: "3D9C6906-5FBD-4736-87B6-720E288E394A", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.13:*:*:*:*:*:*:*", matchCriteriaId: "4931FF86-51B6-470A-A2E0-A1B0942D1CF5", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.13.1:*:*:*:*:*:*:*", matchCriteriaId: "FA9DA33F-A33E-483E-AE4D-4422D62C02E6", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.13.2:*:*:*:*:*:*:*", matchCriteriaId: "F5028DB2-87D5-4AD8-87D4-325C519D6CD9", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.14:*:*:*:*:*:*:*", matchCriteriaId: "E992CDB0-A787-4F7E-AC55-13FE7C68A1D6", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.14.1:*:*:*:*:*:*:*", matchCriteriaId: "808143C5-108B-45BE-B626-A44F9F956018", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.15:*:*:*:*:*:*:*", matchCriteriaId: "8EBBB3F1-98BD-40D1-B09F-1924D567625A", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.15.1:*:*:*:*:*:*:*", matchCriteriaId: "88D5DAE5-ABEA-4FF1-836C-BA4741F13323", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.15.2:*:*:*:*:*:*:*", matchCriteriaId: "7E15191F-D4E6-425C-81BE-2CD55A815B5C", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.15.3:*:*:*:*:*:*:*", matchCriteriaId: "0407CCC0-ACAA-4B2A-99A5-DA57791057B3", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.16.3:*:*:*:*:*:*:*", matchCriteriaId: "248D86F7-A8E5-448D-A55A-C05278BB9822", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.19.3:*:*:*:*:*:*:*", matchCriteriaId: "EBACF741-C988-4800-A9FF-E4836A1EE4E8", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.", }, { lang: "es", value: "La implementación de redirección en curl y libcurl v5.11 hasta v7.19.3, cuando CURLOPT_FOLLOWLOCATION esta activado, acepta valores de localización a elección del usuario, lo que permite a servidores HTTP remotos (1)iniciar peticiones arbitrarias a servidores de red interna, (2) leer o sobreescribir ficheros arbitrariamente a través de una redirección a un fichero: URL, o (3) ejecutar comando arbitrariamente a través de una redirección a un scp: URL.", }, ], id: "CVE-2009-0037", lastModified: "2024-11-21T00:58:55.340", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: true, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], }, published: "2009-03-05T02:30:00.250", references: [ { source: "secalert@redhat.com", tags: [ "Patch", "Vendor Advisory", ], url: "http://curl.haxx.se/docs/adv_20090303.html", }, { source: "secalert@redhat.com", tags: [ "Patch", "Vendor Advisory", ], url: "http://curl.haxx.se/lxr/source/CHANGES", }, { source: "secalert@redhat.com", url: "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html", }, { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html", }, { source: "secalert@redhat.com", url: "http://lists.vmware.com/pipermail/security-announce/2009/000060.html", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/34138", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/34202", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/34237", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/34251", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/34255", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/34259", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/34399", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/35766", }, { source: "secalert@redhat.com", url: "http://security.gentoo.org/glsa/glsa-200903-21.xml", }, { source: "secalert@redhat.com", url: "http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.476602", }, { source: "secalert@redhat.com", url: "http://support.apple.com/kb/HT4077", }, { source: "secalert@redhat.com", url: "http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0042", }, { source: "secalert@redhat.com", url: "http://www.debian.org/security/2009/dsa-1738", }, { source: "secalert@redhat.com", url: "http://www.redhat.com/support/errata/RHSA-2009-0341.html", }, { source: "secalert@redhat.com", url: "http://www.securityfocus.com/archive/1/501757/100/0/threaded", }, { source: "secalert@redhat.com", url: "http://www.securityfocus.com/archive/1/504849/100/0/threaded", }, { source: "secalert@redhat.com", tags: [ "Exploit", "Patch", ], url: "http://www.securityfocus.com/bid/33962", }, { source: "secalert@redhat.com", url: "http://www.securitytracker.com/id?1021783", }, { source: "secalert@redhat.com", url: "http://www.ubuntu.com/usn/USN-726-1", }, { source: "secalert@redhat.com", url: "http://www.vmware.com/security/advisories/VMSA-2009-0009.html", }, { source: "secalert@redhat.com", tags: [ "Patch", "Vendor Advisory", ], url: "http://www.vupen.com/english/advisories/2009/0581", }, { source: "secalert@redhat.com", url: "http://www.vupen.com/english/advisories/2009/1865", }, { source: "secalert@redhat.com", url: "http://www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/", }, { source: "secalert@redhat.com", url: "http://www.withdk.com/archives/Libcurl_arbitrary_file_access.pdf", }, { source: "secalert@redhat.com", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/49030", }, { source: "secalert@redhat.com", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11054", }, { source: "secalert@redhat.com", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6074", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://curl.haxx.se/docs/adv_20090303.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://curl.haxx.se/lxr/source/CHANGES", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.vmware.com/pipermail/security-announce/2009/000060.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/34138", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/34202", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/34237", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/34251", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/34255", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/34259", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/34399", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/35766", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://security.gentoo.org/glsa/glsa-200903-21.xml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.476602", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://support.apple.com/kb/HT4077", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0042", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.debian.org/security/2009/dsa-1738", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.redhat.com/support/errata/RHSA-2009-0341.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/archive/1/501757/100/0/threaded", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/archive/1/504849/100/0/threaded", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Patch", ], url: "http://www.securityfocus.com/bid/33962", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securitytracker.com/id?1021783", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.ubuntu.com/usn/USN-726-1", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.vmware.com/security/advisories/VMSA-2009-0009.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://www.vupen.com/english/advisories/2009/0581", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.vupen.com/english/advisories/2009/1865", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.withdk.com/archives/Libcurl_arbitrary_file_access.pdf", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/49030", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11054", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6074", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-352", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2005-10-13 22:02
Modified
2024-11-21 00:01
Severity ?
Summary
Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.
References
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:curl:curl:7.13.2:*:*:*:*:*:*:*", matchCriteriaId: "B2458D0E-66F7-484C-9989-308530AE766D", vulnerable: true, }, { criteria: "cpe:2.3:a:libcurl:libcurl:7.13.2:*:*:*:*:*:*:*", matchCriteriaId: "D0A61633-B9B8-44B5-B352-29F4BFBD2BD1", vulnerable: true, }, { criteria: "cpe:2.3:a:wget:wget:1.10:*:*:*:*:*:*:*", matchCriteriaId: "551786A9-941B-4FCF-A9F4-EFC560CE5316", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.", }, ], id: "CVE-2005-3185", lastModified: "2024-11-21T00:01:18.190", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: true, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2005-10-13T22:02:00.000", references: [ { source: "cve@mitre.org", url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.10/SCOSA-2006.10.txt", }, { source: "cve@mitre.org", url: "http://docs.info.apple.com/article.html?artnum=302847", }, { source: "cve@mitre.org", url: "http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17192", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17193", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17203", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17208", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17228", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17247", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17297", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17320", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17400", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17403", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17485", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17813", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17965", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/19193", }, { source: "cve@mitre.org", url: "http://securityreason.com/securityalert/82", }, { source: "cve@mitre.org", url: "http://securitytracker.com/id?1015056", }, { source: "cve@mitre.org", url: "http://securitytracker.com/id?1015057", }, { source: "cve@mitre.org", url: "http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.519010", }, { source: "cve@mitre.org", url: "http://www.debian.org/security/2005/dsa-919", }, { source: "cve@mitre.org", url: "http://www.gentoo.org/security/en/glsa/glsa-200510-19.xml", }, { source: "cve@mitre.org", tags: [ "Patch", "Vendor Advisory", ], url: "http://www.idefense.com/application/poi/display?id=322&type=vulnerabilities", }, { source: "cve@mitre.org", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:182", }, { source: "cve@mitre.org", url: "http://www.novell.com/linux/security/advisories/2005_63_wget_curl.html", }, { source: "cve@mitre.org", url: "http://www.osvdb.org/20011", }, { source: "cve@mitre.org", url: "http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00020.html", }, { source: "cve@mitre.org", url: "http://www.redhat.com/archives/fedora-announce-list/2005-October/msg00055.html", }, { source: "cve@mitre.org", url: "http://www.redhat.com/support/errata/RHSA-2005-807.html", }, { source: "cve@mitre.org", url: "http://www.redhat.com/support/errata/RHSA-2005-812.html", }, { source: "cve@mitre.org", url: "http://www.securityfocus.com/bid/15102", }, { source: "cve@mitre.org", url: "http://www.securityfocus.com/bid/15647", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://www.vupen.com/english/advisories/2005/2088", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://www.vupen.com/english/advisories/2005/2125", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://www.vupen.com/english/advisories/2005/2659", }, { source: "cve@mitre.org", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/22721", }, { source: "cve@mitre.org", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9810", }, { source: "cve@mitre.org", url: "https://usn.ubuntu.com/205-1/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.10/SCOSA-2006.10.txt", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://docs.info.apple.com/article.html?artnum=302847", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17192", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17193", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17203", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17208", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17228", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17247", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17297", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17320", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17400", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17403", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17485", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17813", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/17965", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/19193", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://securityreason.com/securityalert/82", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://securitytracker.com/id?1015056", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://securitytracker.com/id?1015057", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.519010", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.debian.org/security/2005/dsa-919", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.gentoo.org/security/en/glsa/glsa-200510-19.xml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://www.idefense.com/application/poi/display?id=322&type=vulnerabilities", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:182", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.novell.com/linux/security/advisories/2005_63_wget_curl.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.osvdb.org/20011", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00020.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.redhat.com/archives/fedora-announce-list/2005-October/msg00055.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.redhat.com/support/errata/RHSA-2005-807.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.redhat.com/support/errata/RHSA-2005-812.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/15102", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/15647", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://www.vupen.com/english/advisories/2005/2088", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://www.vupen.com/english/advisories/2005/2125", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://www.vupen.com/english/advisories/2005/2659", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/22721", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9810", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://usn.ubuntu.com/205-1/", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-119", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2012-04-13 20:55
Modified
2024-11-21 01:34
Severity ?
Summary
curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| curl | curl | 7.20.0 | |
| curl | curl | 7.20.1 | |
| curl | curl | 7.21.0 | |
| curl | curl | 7.21.1 | |
| curl | curl | 7.21.2 | |
| curl | curl | 7.21.3 | |
| curl | curl | 7.21.4 | |
| curl | curl | 7.21.5 | |
| curl | curl | 7.21.6 | |
| curl | curl | 7.21.7 | |
| curl | curl | 7.22.0 | |
| curl | curl | 7.23.0 | |
| curl | curl | 7.23.1 | |
| curl | libcurl | 7.20.0 | |
| curl | libcurl | 7.20.1 | |
| curl | libcurl | 7.21.0 | |
| curl | libcurl | 7.21.1 | |
| curl | libcurl | 7.21.2 | |
| curl | libcurl | 7.21.3 | |
| curl | libcurl | 7.21.4 | |
| curl | libcurl | 7.21.5 | |
| curl | libcurl | 7.21.6 | |
| curl | libcurl | 7.21.7 | |
| curl | libcurl | 7.22.0 | |
| curl | libcurl | 7.23.0 | |
| curl | libcurl | 7.23.1 |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:curl:curl:7.20.0:*:*:*:*:*:*:*", matchCriteriaId: "A9BDFC51-3AB0-4C43-8979-ECA18E8035C5", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.20.1:*:*:*:*:*:*:*", matchCriteriaId: "A3AC9C63-FD5E-4315-B9AF-9D8B1E988F98", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.21.0:*:*:*:*:*:*:*", matchCriteriaId: "B05A4F5A-C65D-4662-8373-4FEA07558CBA", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.21.1:*:*:*:*:*:*:*", matchCriteriaId: "85ADB9E1-0356-4E55-B7FD-6425EAF2C643", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.21.2:*:*:*:*:*:*:*", matchCriteriaId: "1EBA4E51-1C4B-4C2A-B13E-11D4FD9C1C50", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.21.3:*:*:*:*:*:*:*", matchCriteriaId: "A333EB08-4E37-41EF-A204-C82CECE9A51D", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.21.4:*:*:*:*:*:*:*", matchCriteriaId: "E29638D1-2620-46A2-BE15-4706B7C4E678", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.21.5:*:*:*:*:*:*:*", matchCriteriaId: "AA6D4422-C5C8-440F-B476-84DE445966DB", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.21.6:*:*:*:*:*:*:*", matchCriteriaId: "D4506D93-8DBC-4E33-9432-C4A8CA3BDE6A", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.21.7:*:*:*:*:*:*:*", matchCriteriaId: "5DADC1B7-2945-4CEC-A1D9-0CCA785F165D", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.22.0:*:*:*:*:*:*:*", matchCriteriaId: "B7CFA6F8-A6B1-415A-8DFB-EA4AFA67160E", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.23.0:*:*:*:*:*:*:*", matchCriteriaId: "F7C18D23-0401-41C2-BAD7-8B2965691EF6", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.23.1:*:*:*:*:*:*:*", matchCriteriaId: "A93EF4F2-101C-4FAD-A8F6-7A19EE2D6C8F", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:curl:libcurl:7.20.0:*:*:*:*:*:*:*", matchCriteriaId: "34341428-2676-4431-A23F-65FBE90BAD3A", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.20.1:*:*:*:*:*:*:*", matchCriteriaId: "D0B31BF7-F04D-4985-A0F2-5206D678D3CF", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.21.0:*:*:*:*:*:*:*", matchCriteriaId: "1E2630C2-3E7C-4836-A548-819679967099", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.21.1:*:*:*:*:*:*:*", matchCriteriaId: "36FDE251-B1E1-4989-9ECB-07D4A760384E", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.21.2:*:*:*:*:*:*:*", matchCriteriaId: "E52D4877-8ED5-4057-A55D-5C5F82175737", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.21.3:*:*:*:*:*:*:*", matchCriteriaId: "77A81783-51FB-43F4-9D83-5E6134BADB08", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.21.4:*:*:*:*:*:*:*", matchCriteriaId: "31022B8A-B4D6-4F6B-9643-1266A65A3807", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.21.5:*:*:*:*:*:*:*", matchCriteriaId: "6ACEDA5F-8B32-4898-A1B9-7FCC8110F54A", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.21.6:*:*:*:*:*:*:*", matchCriteriaId: "24F20A9A-78F4-463B-A2C5-58721CE46210", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.21.7:*:*:*:*:*:*:*", matchCriteriaId: "8F4A1953-91D9-4B20-9A13-4974DA86683B", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.22.0:*:*:*:*:*:*:*", matchCriteriaId: "2FFBF499-9028-4A50-B6FC-2B2D3AD7E9AD", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.23.0:*:*:*:*:*:*:*", matchCriteriaId: "BD5BCA31-3875-4585-8E42-8FAE354049A3", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:libcurl:7.23.1:*:*:*:*:*:*:*", matchCriteriaId: "9AA5ADA7-629B-4028-A023-DF119527A522", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.", }, { lang: "es", value: "curl y libcurl v7.2x anteriores v7.24.0 no consideran de forma adecuada los caracteres especiales cuando extraen una ruta de un fichero de una URL, lo que permite a atacantes remotos realizar ataques de injección de datos mediente una URL manipulada, como se demostró mediante un atque de injección CRLF sobre los protocolos (1) IMAP, (2) POP3, y (3) SMTP.", }, ], id: "CVE-2012-0036", lastModified: "2024-11-21T01:34:15.543", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2012-04-13T20:55:01.493", references: [ { source: "secalert@redhat.com", tags: [ "Patch", ], url: "http://curl.haxx.se/curl-url-sanitize.patch", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "http://curl.haxx.se/docs/adv_20120124.html", }, { source: "secalert@redhat.com", url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041", }, { source: "secalert@redhat.com", url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041", }, { source: "secalert@redhat.com", url: "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/48256", }, { source: "secalert@redhat.com", url: "http://security.gentoo.org/glsa/glsa-201203-02.xml", }, { source: "secalert@redhat.com", url: "http://support.apple.com/kb/HT5281", }, { source: "secalert@redhat.com", url: "http://www.debian.org/security/2012/dsa-2398", }, { source: "secalert@redhat.com", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2012:058", }, { source: "secalert@redhat.com", url: "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html", }, { source: "secalert@redhat.com", url: "http://www.securityfocus.com/bid/51665", }, { source: "secalert@redhat.com", url: "http://www.securitytracker.com/id/1032924", }, { source: "secalert@redhat.com", url: "https://bugzilla.redhat.com/show_bug.cgi?id=773457", }, { source: "secalert@redhat.com", url: "https://github.com/bagder/curl/commit/75ca568fa1c19de4c5358fed246686de8467c238", }, { source: "secalert@redhat.com", url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03760en_us", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://curl.haxx.se/curl-url-sanitize.patch", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://curl.haxx.se/docs/adv_20120124.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/48256", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://security.gentoo.org/glsa/glsa-201203-02.xml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://support.apple.com/kb/HT5281", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.debian.org/security/2012/dsa-2398", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2012:058", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/51665", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securitytracker.com/id/1032924", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://bugzilla.redhat.com/show_bug.cgi?id=773457", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://github.com/bagder/curl/commit/75ca568fa1c19de4c5358fed246686de8467c238", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03760en_us", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-89", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2010-10-28 00:00
Modified
2024-11-21 01:19
Severity ?
Summary
Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ (backslash) as a separator of path components within the Content-disposition HTTP header.
References
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:curl:curl:7.20.0:*:*:*:*:*:*:*", matchCriteriaId: "A9BDFC51-3AB0-4C43-8979-ECA18E8035C5", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.20.1:*:*:*:*:*:*:*", matchCriteriaId: "A3AC9C63-FD5E-4315-B9AF-9D8B1E988F98", vulnerable: true, }, { criteria: "cpe:2.3:a:curl:curl:7.21.1:*:*:*:*:*:*:*", matchCriteriaId: "85ADB9E1-0356-4E55-B7FD-6425EAF2C643", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \\ (backslash) as a separator of path components within the Content-disposition HTTP header.", }, { lang: "es", value: "Vulnerabilidad de salto de directorio absoluto en curl v7.20.0 hasta v7.21.1, cuando se utiliza la opción --remote-header-name o -J, permite a los servidores remotos crear o sobreescribir archivos arbitrarios mediante el uso de \\ (barra invertida) como un separador de componentes de la ruta dentro de la cabecera HTTP Content-disposition.", }, ], id: "CVE-2010-3842", lastModified: "2024-11-21T01:19:44.153", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5.8, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:P", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 4.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2010-10-28T00:00:05.453", references: [ { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "http://curl.haxx.se/docs/adv_20101013.html", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/39532", }, { source: "secalert@redhat.com", url: "http://securitytracker.com/id?1024583", }, { source: "secalert@redhat.com", url: "http://www.openwall.com/lists/oss-security/2010/10/13/1", }, { source: "secalert@redhat.com", tags: [ "Patch", ], url: "http://www.openwall.com/lists/oss-security/2010/10/13/4", }, { source: "secalert@redhat.com", url: "http://www.openwall.com/lists/oss-security/2010/10/13/5", }, { source: "secalert@redhat.com", url: "https://bugzilla.redhat.com/show_bug.cgi?id=642642", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://curl.haxx.se/docs/adv_20101013.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/39532", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://securitytracker.com/id?1024583", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.openwall.com/lists/oss-security/2010/10/13/1", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://www.openwall.com/lists/oss-security/2010/10/13/4", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.openwall.com/lists/oss-security/2010/10/13/5", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://bugzilla.redhat.com/show_bug.cgi?id=642642", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-22", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }