CVE-2018-1000005
published 2018-01-24CVE-2018-1000005: libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231)…
PriorityP346critical9.1CVSS 3.0
AVNACLPRNUINSUCHINAH
EPSS
4.64%
90.5th percentile
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | curl | < curl 7.58.0-1 (bookworm) | curl 7.58.0-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| haxx | curl | >= 0 < 7.58.0-1 | 7.58.0-1 |
| haxx | curl | >= 0 < 7.58.0-1 | 7.58.0-1 |
| haxx | curl | >= 0 < 7.58.0-1 | 7.58.0-1 |
| haxx | curl | >= 0 < 7.58.0-1 | 7.58.0-1 |
| haxx | libcurl | 7.49.0 – 7.57.0 | — |
CVSS provenance
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
osv9.1CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian9.1CRITICAL
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
curl vulnerabilities
vendor_ubuntu·2018-01-31·CVSS 9.8
CVE-2018-1000005 [CRITICAL] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
It was discovered that curl incorrectly handled certain data. An attacker
could possibly use this to cause a denial of service or even to get access
to sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10.
It was discovered that curl could accidentally leak authentication data.
An attacker could possibly use this to get access to sensitive information.
(CVE-2018-1000007)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
curl: Out-of-bounds read in code handling HTTP/2 trailers
vendor_redhat·2018-01-24·CVSS 9.1
CVE-2018-1000005 [CRITICAL] CWE-125 curl: Out-of-bounds read in code handling HTTP/2 trailers
curl: Out-of-bounds read in code handling HTTP/2 trailers
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an inform
Debian
CVE-2018-1000005: curl - libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handl...
vendor_debian·2018·CVSS 9.1
CVE-2018-1000005 [CRITICAL] CVE-2018-1000005: curl - libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handl...
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back
GHSA
GHSA-cj8j-r7q8-xg4f: libcurl 7
ghsa_unreviewed·2022-05-14
CVE-2018-1000005 [CRITICAL] CWE-125 GHSA-cj8j-r7q8-xg4f: libcurl 7
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back
OSV
CVE-2018-1000005: libcurl 7
osv·2018-01-24·CVSS 9.1
CVE-2018-1000005 [CRITICAL] CVE-2018-1000005: libcurl 7
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-1000005 mingw-curl: curl: Out-of-bounds read in code handling HTTP/2 trailers [fedora-all]
bugzilla·2019-04-15·CVSS 9.1
CVE-2018-1000005 [CRITICAL] CVE-2018-1000005 mingw-curl: curl: Out-of-bounds read in code handling HTTP/2 trailers [fedora-all]
CVE-2018-1000005 mingw-curl: curl: Out-of-bounds read in code handling HTTP/2 trailers [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multi
Bugzilla
CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers [fedora-all]
bugzilla·2019-04-15·CVSS 9.1
CVE-2018-1000005 [CRITICAL] CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers [fedora-all]
CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supporte
Bugzilla
CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers
bugzilla·2018-01-18·CVSS 9.1
CVE-2018-1000005 [CRITICAL] CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers
CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers
An out-of-bounds read in code handling HTTP/2 trailers was found. This could lead to a denial-of-service or an information disclosure in some circumstances.
Affected versions: libcurl 7.49.0 to and including 7.57.0
Not affected versions: libcurl = 7.58.0
Upstream bug report:
https://github.com/curl/curl/pull/2231
Upstream patch:
https://github.com/curl/curl/commit/fa3dbb9a147488a294.patch
Discussion:
Acknowledgments:
Name: the Curl project
Upstream: Zhouyihai Ding
---
External References:
https://curl.haxx.se/docs/adv_2018-824a.html
---
The latest version of curl shipped by ceph-2 is 7.29.0-32.el7(~3 years back), however which is not affected by this flaw. Ceph-2 no more ships updated version of curl a
http://www.securitytracker.com/id/1040273https://access.redhat.com/errata/RHSA-2019:1543https://curl.haxx.se/docs/adv_2018-824a.htmlhttps://github.com/curl/curl/pull/2231https://usn.ubuntu.com/3554-1/https://www.debian.org/security/2018/dsa-4098http://www.securitytracker.com/id/1040273https://access.redhat.com/errata/RHSA-2019:1543https://curl.haxx.se/docs/adv_2018-824a.htmlhttps://github.com/curl/curl/pull/2231https://usn.ubuntu.com/3554-1/https://www.debian.org/security/2018/dsa-4098
2018-01-24
Published