CVE-2018-1000005
When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something.
- CVSS 3.0
- 9.1 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- EPSS
- 4.56% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- haxx/libcurl · debian/debian linux · canonical/ubuntu linux
- Source
- cve@mitre.org
References
- http://www.securitytracker.com/id/1040273Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:1543
- https://curl.haxx.se/docs/adv_2018-824a.htmlPatch, Vendor Advisory
- https://github.com/curl/curl/pull/2231Issue Tracking, Patch, Third Party Advisory
- https://usn.ubuntu.com/3554-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4098Third Party Advisory
- http://www.securitytracker.com/id/1040273Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:1543
- https://curl.haxx.se/docs/adv_2018-824a.htmlPatch, Vendor Advisory
- https://github.com/curl/curl/pull/2231Issue Tracking, Patch, Third Party Advisory
- https://usn.ubuntu.com/3554-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4098Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.