gsd - gsd-2024-2398

gsd-2024-2398

Vulnerability from gsd

Modified

2024-04-02 05:02

Details

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Aliases

CVE-2024-2398

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-2398"
      ],
      "details": "When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application.",
      "id": "GSD-2024-2398",
      "modified": "2024-04-02T05:02:53.369064Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@curl.se",
        "ID": "CVE-2024-2398",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "curl",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.6.0",
                          "version_value": "8.6.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.5.0",
                          "version_value": "8.5.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.4.0",
                          "version_value": "8.4.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.3.0",
                          "version_value": "8.3.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.2.1",
                          "version_value": "8.2.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.2.0",
                          "version_value": "8.2.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.1.2",
                          "version_value": "8.1.2"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.1.1",
                          "version_value": "8.1.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.1.0",
                          "version_value": "8.1.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.0.1",
                          "version_value": "8.0.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "8.0.0",
                          "version_value": "8.0.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.88.1",
                          "version_value": "7.88.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.88.0",
                          "version_value": "7.88.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.87.0",
                          "version_value": "7.87.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.86.0",
                          "version_value": "7.86.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.85.0",
                          "version_value": "7.85.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.84.0",
                          "version_value": "7.84.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.83.1",
                          "version_value": "7.83.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.83.0",
                          "version_value": "7.83.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.82.0",
                          "version_value": "7.82.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.81.0",
                          "version_value": "7.81.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.80.0",
                          "version_value": "7.80.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.79.1",
                          "version_value": "7.79.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.79.0",
                          "version_value": "7.79.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.78.0",
                          "version_value": "7.78.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.77.0",
                          "version_value": "7.77.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.76.1",
                          "version_value": "7.76.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.76.0",
                          "version_value": "7.76.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.75.0",
                          "version_value": "7.75.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.74.0",
                          "version_value": "7.74.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.73.0",
                          "version_value": "7.73.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.72.0",
                          "version_value": "7.72.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.71.1",
                          "version_value": "7.71.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.71.0",
                          "version_value": "7.71.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.70.0",
                          "version_value": "7.70.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.69.1",
                          "version_value": "7.69.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.69.0",
                          "version_value": "7.69.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.68.0",
                          "version_value": "7.68.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.67.0",
                          "version_value": "7.67.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.66.0",
                          "version_value": "7.66.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.65.3",
                          "version_value": "7.65.3"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.65.2",
                          "version_value": "7.65.2"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.65.1",
                          "version_value": "7.65.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.65.0",
                          "version_value": "7.65.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.64.1",
                          "version_value": "7.64.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.64.0",
                          "version_value": "7.64.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.63.0",
                          "version_value": "7.63.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.62.0",
                          "version_value": "7.62.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.61.1",
                          "version_value": "7.61.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.61.0",
                          "version_value": "7.61.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.60.0",
                          "version_value": "7.60.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.59.0",
                          "version_value": "7.59.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.58.0",
                          "version_value": "7.58.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.57.0",
                          "version_value": "7.57.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.56.1",
                          "version_value": "7.56.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.56.0",
                          "version_value": "7.56.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.55.1",
                          "version_value": "7.55.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.55.0",
                          "version_value": "7.55.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.54.1",
                          "version_value": "7.54.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.54.0",
                          "version_value": "7.54.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.53.1",
                          "version_value": "7.53.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.53.0",
                          "version_value": "7.53.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.52.1",
                          "version_value": "7.52.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.52.0",
                          "version_value": "7.52.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.51.0",
                          "version_value": "7.51.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.50.3",
                          "version_value": "7.50.3"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.50.2",
                          "version_value": "7.50.2"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.50.1",
                          "version_value": "7.50.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.50.0",
                          "version_value": "7.50.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.49.1",
                          "version_value": "7.49.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.49.0",
                          "version_value": "7.49.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.48.0",
                          "version_value": "7.48.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.47.1",
                          "version_value": "7.47.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.47.0",
                          "version_value": "7.47.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.46.0",
                          "version_value": "7.46.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.45.0",
                          "version_value": "7.45.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.44.0",
                          "version_value": "7.44.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "curl"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "w0x42 on hackerone"
        },
        {
          "lang": "en",
          "value": "Stefan Eissing"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-772 Missing Release of Resource after Effective Lifetime "
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://curl.se/docs/CVE-2024-2398.json",
            "refsource": "MISC",
            "url": "https://curl.se/docs/CVE-2024-2398.json"
          },
          {
            "name": "https://curl.se/docs/CVE-2024-2398.html",
            "refsource": "MISC",
            "url": "https://curl.se/docs/CVE-2024-2398.html"
          },
          {
            "name": "https://hackerone.com/reports/2402845",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/2402845"
          },
          {
            "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/",
            "refsource": "MISC",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/"
          },
          {
            "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/",
            "refsource": "MISC",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."
          },
          {
            "lang": "es",
            "value": "Cuando una aplicaci\u00f3n le dice a libcurl que quiere permitir la inserci\u00f3n del servidor HTTP/2 y la cantidad de encabezados recibidos para la inserci\u00f3n supera el l\u00edmite m\u00e1ximo permitido (1000), libcurl cancela la inserci\u00f3n del servidor. Al cancelar, libcurl inadvertidamente no libera todos los encabezados previamente asignados y, en cambio, pierde memoria. Adem\u00e1s, esta condici\u00f3n de error falla silenciosamente y, por lo tanto, una aplicaci\u00f3n no la detecta f\u00e1cilmente."
          }
        ],
        "id": "CVE-2024-2398",
        "lastModified": "2024-04-25T06:15:58.640",
        "metrics": {},
        "published": "2024-03-27T08:15:41.283",
        "references": [
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://curl.se/docs/CVE-2024-2398.html"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://curl.se/docs/CVE-2024-2398.json"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://hackerone.com/reports/2402845"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/"
          }
        ],
        "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "vulnStatus": "Awaiting Analysis"
      }
    }
  }
}

cve-2024-2398

Vulnerability from cvelistv5

Published

2024-03-27 07:55

Modified

2024-08-01 19:11

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Summary

HTTP/2 push headers memory-leak

References

▼	URL	Tags
	https://curl.se/docs/CVE-2024-2398.json
	https://curl.se/docs/CVE-2024-2398.html
	https://hackerone.com/reports/2402845
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
	http://www.openwall.com/lists/oss-security/2024/03/27/3
	https://security.netapp.com/advisory/ntap-20240503-0009/
	https://support.apple.com/kb/HT214119
	https://support.apple.com/kb/HT214118
	https://support.apple.com/kb/HT214120
	http://seclists.org/fulldisclosure/2024/Jul/20
	http://seclists.org/fulldisclosure/2024/Jul/18
	http://seclists.org/fulldisclosure/2024/Jul/19

Impacted products

Vendor

Product

Version

▼

curl

Version: 8.6.0   ≤ 8.6.0
Version: 8.5.0   ≤ 8.5.0
Version: 8.4.0   ≤ 8.4.0
Version: 8.3.0   ≤ 8.3.0
Version: 8.2.1   ≤ 8.2.1
Version: 8.2.0   ≤ 8.2.0
Version: 8.1.2   ≤ 8.1.2
Version: 8.1.1   ≤ 8.1.1
Version: 8.1.0   ≤ 8.1.0
Version: 8.0.1   ≤ 8.0.1
Version: 8.0.0   ≤ 8.0.0
Version: 7.88.1   ≤ 7.88.1
Version: 7.88.0   ≤ 7.88.0
Version: 7.87.0   ≤ 7.87.0
Version: 7.86.0   ≤ 7.86.0
Version: 7.85.0   ≤ 7.85.0
Version: 7.84.0   ≤ 7.84.0
Version: 7.83.1   ≤ 7.83.1
Version: 7.83.0   ≤ 7.83.0
Version: 7.82.0   ≤ 7.82.0
Version: 7.81.0   ≤ 7.81.0
Version: 7.80.0   ≤ 7.80.0
Version: 7.79.1   ≤ 7.79.1
Version: 7.79.0   ≤ 7.79.0
Version: 7.78.0   ≤ 7.78.0
Version: 7.77.0   ≤ 7.77.0
Version: 7.76.1   ≤ 7.76.1
Version: 7.76.0   ≤ 7.76.0
Version: 7.75.0   ≤ 7.75.0
Version: 7.74.0   ≤ 7.74.0
Version: 7.73.0   ≤ 7.73.0
Version: 7.72.0   ≤ 7.72.0
Version: 7.71.1   ≤ 7.71.1
Version: 7.71.0   ≤ 7.71.0
Version: 7.70.0   ≤ 7.70.0
Version: 7.69.1   ≤ 7.69.1
Version: 7.69.0   ≤ 7.69.0
Version: 7.68.0   ≤ 7.68.0
Version: 7.67.0   ≤ 7.67.0
Version: 7.66.0   ≤ 7.66.0
Version: 7.65.3   ≤ 7.65.3
Version: 7.65.2   ≤ 7.65.2
Version: 7.65.1   ≤ 7.65.1
Version: 7.65.0   ≤ 7.65.0
Version: 7.64.1   ≤ 7.64.1
Version: 7.64.0   ≤ 7.64.0
Version: 7.63.0   ≤ 7.63.0
Version: 7.62.0   ≤ 7.62.0
Version: 7.61.1   ≤ 7.61.1
Version: 7.61.0   ≤ 7.61.0
Version: 7.60.0   ≤ 7.60.0
Version: 7.59.0   ≤ 7.59.0
Version: 7.58.0   ≤ 7.58.0
Version: 7.57.0   ≤ 7.57.0
Version: 7.56.1   ≤ 7.56.1
Version: 7.56.0   ≤ 7.56.0
Version: 7.55.1   ≤ 7.55.1
Version: 7.55.0   ≤ 7.55.0
Version: 7.54.1   ≤ 7.54.1
Version: 7.54.0   ≤ 7.54.0
Version: 7.53.1   ≤ 7.53.1
Version: 7.53.0   ≤ 7.53.0
Version: 7.52.1   ≤ 7.52.1
Version: 7.52.0   ≤ 7.52.0
Version: 7.51.0   ≤ 7.51.0
Version: 7.50.3   ≤ 7.50.3
Version: 7.50.2   ≤ 7.50.2
Version: 7.50.1   ≤ 7.50.1
Version: 7.50.0   ≤ 7.50.0
Version: 7.49.1   ≤ 7.49.1
Version: 7.49.0   ≤ 7.49.0
Version: 7.48.0   ≤ 7.48.0
Version: 7.47.1   ≤ 7.47.1
Version: 7.47.0   ≤ 7.47.0
Version: 7.46.0   ≤ 7.46.0
Version: 7.45.0   ≤ 7.45.0
Version: 7.44.0   ≤ 7.44.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:curl:curl:7.4:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "curl",
            "vendor": "curl",
            "versions": [
              {
                "lessThanOrEqual": "8.6.0",
                "status": "affected",
                "version": "7.44.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 8.6,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-2398",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-26T18:57:39.256472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:30:40.286Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T19:11:53.566Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "json",
            "tags": [
              "x_transferred"
            ],
            "url": "https://curl.se/docs/CVE-2024-2398.json"
          },
          {
            "name": "www",
            "tags": [
              "x_transferred"
            ],
            "url": "https://curl.se/docs/CVE-2024-2398.html"
          },
          {
            "name": "issue",
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/2402845"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/27/3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240503-0009/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214119"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214118"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214120"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/20"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/18"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/19"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.6.0",
              "status": "affected",
              "version": "8.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.0",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.4.0",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.3.0",
              "status": "affected",
              "version": "8.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.1",
              "status": "affected",
              "version": "8.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.0",
              "status": "affected",
              "version": "8.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.2",
              "status": "affected",
              "version": "8.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.1",
              "status": "affected",
              "version": "8.1.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.0",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.1",
              "status": "affected",
              "version": "7.88.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.0",
              "status": "affected",
              "version": "7.88.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.87.0",
              "status": "affected",
              "version": "7.87.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.86.0",
              "status": "affected",
              "version": "7.86.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.85.0",
              "status": "affected",
              "version": "7.85.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.84.0",
              "status": "affected",
              "version": "7.84.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.1",
              "status": "affected",
              "version": "7.83.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.0",
              "status": "affected",
              "version": "7.83.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.82.0",
              "status": "affected",
              "version": "7.82.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.81.0",
              "status": "affected",
              "version": "7.81.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.80.0",
              "status": "affected",
              "version": "7.80.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.1",
              "status": "affected",
              "version": "7.79.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.0",
              "status": "affected",
              "version": "7.79.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.78.0",
              "status": "affected",
              "version": "7.78.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.77.0",
              "status": "affected",
              "version": "7.77.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.1",
              "status": "affected",
              "version": "7.76.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.0",
              "status": "affected",
              "version": "7.76.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.75.0",
              "status": "affected",
              "version": "7.75.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.74.0",
              "status": "affected",
              "version": "7.74.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.73.0",
              "status": "affected",
              "version": "7.73.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.72.0",
              "status": "affected",
              "version": "7.72.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.1",
              "status": "affected",
              "version": "7.71.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.0",
              "status": "affected",
              "version": "7.71.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.70.0",
              "status": "affected",
              "version": "7.70.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.1",
              "status": "affected",
              "version": "7.69.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.0",
              "status": "affected",
              "version": "7.69.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.68.0",
              "status": "affected",
              "version": "7.68.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.67.0",
              "status": "affected",
              "version": "7.67.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.66.0",
              "status": "affected",
              "version": "7.66.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.3",
              "status": "affected",
              "version": "7.65.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.2",
              "status": "affected",
              "version": "7.65.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.1",
              "status": "affected",
              "version": "7.65.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.0",
              "status": "affected",
              "version": "7.65.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.64.1",
              "status": "affected",
              "version": "7.64.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.64.0",
              "status": "affected",
              "version": "7.64.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.63.0",
              "status": "affected",
              "version": "7.63.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.62.0",
              "status": "affected",
              "version": "7.62.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.61.1",
              "status": "affected",
              "version": "7.61.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.61.0",
              "status": "affected",
              "version": "7.61.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.60.0",
              "status": "affected",
              "version": "7.60.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.59.0",
              "status": "affected",
              "version": "7.59.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.58.0",
              "status": "affected",
              "version": "7.58.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.57.0",
              "status": "affected",
              "version": "7.57.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.56.1",
              "status": "affected",
              "version": "7.56.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.56.0",
              "status": "affected",
              "version": "7.56.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.55.1",
              "status": "affected",
              "version": "7.55.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.55.0",
              "status": "affected",
              "version": "7.55.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.54.1",
              "status": "affected",
              "version": "7.54.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.54.0",
              "status": "affected",
              "version": "7.54.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.53.1",
              "status": "affected",
              "version": "7.53.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.53.0",
              "status": "affected",
              "version": "7.53.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.52.1",
              "status": "affected",
              "version": "7.52.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.52.0",
              "status": "affected",
              "version": "7.52.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.51.0",
              "status": "affected",
              "version": "7.51.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.3",
              "status": "affected",
              "version": "7.50.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.2",
              "status": "affected",
              "version": "7.50.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.1",
              "status": "affected",
              "version": "7.50.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.0",
              "status": "affected",
              "version": "7.50.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.49.1",
              "status": "affected",
              "version": "7.49.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.49.0",
              "status": "affected",
              "version": "7.49.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.48.0",
              "status": "affected",
              "version": "7.48.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.47.1",
              "status": "affected",
              "version": "7.47.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.47.0",
              "status": "affected",
              "version": "7.47.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.46.0",
              "status": "affected",
              "version": "7.46.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.45.0",
              "status": "affected",
              "version": "7.45.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.44.0",
              "status": "affected",
              "version": "7.44.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "w0x42 on hackerone"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stefan Eissing"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-772 Missing Release of Resource after Effective Lifetime",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-27T07:55:48.524Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "name": "json",
          "url": "https://curl.se/docs/CVE-2024-2398.json"
        },
        {
          "name": "www",
          "url": "https://curl.se/docs/CVE-2024-2398.html"
        },
        {
          "name": "issue",
          "url": "https://hackerone.com/reports/2402845"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/27/3"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240503-0009/"
        },
        {
          "url": "https://support.apple.com/kb/HT214119"
        },
        {
          "url": "https://support.apple.com/kb/HT214118"
        },
        {
          "url": "https://support.apple.com/kb/HT214120"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Jul/20"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Jul/18"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Jul/19"
        }
      ],
      "title": "HTTP/2 push headers memory-leak"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2024-2398",
    "datePublished": "2024-03-27T07:55:48.524Z",
    "dateReserved": "2024-03-12T10:59:22.660Z",
    "dateUpdated": "2024-08-01T19:11:53.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted