CVE-2024-7264: Vulnerability in curl package - ASN.1 Parser Code
Summary
CVE-2024-7264: libcurl's ASN1 parser code has the GTime2str() function, used for parsing an ASN.1 Generalized Time field. Affects curl across 2 version ranges.
< 8.9.1-r0
< 27959ecce75cdb2809c0bdb3286e60e08fadb519
Fixed in 8.9.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package is a widely used open-source library and command-line tool for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. The package provides a range of features and options for performing network requests and handling data transfers. However, the curl package is vulnerable to a specific issue in its ASN.1 parser code.
Vulnerability Detail
The vulnerability (CVE-2024-7264) in the curl package's ASN.1 parser code arises from the GTime2str() function, responsible for parsing an ASN.1 Generalized Time field. If the parser encounters a syntactically incorrect field, it may incorrectly use -1 as the length of the time fraction. This can lead to a strlen() operation being performed on a pointer to a heap buffer area that is not null terminated. The consequence of this flaw is likely a crash, but it can also result in the application receiving heap contents when using the CURLINFO_CERTINFO option.
How To Fix
Minimum fixed version
8.9.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to follow the fix instructions and update the curl package to a patched version.
Conclusion
The curl package is vulnerable to a flaw in its ASN.1 parser code, which can lead to crashes and potential exposure of heap contents. To address this vulnerability, it is crucial to update the curl package to a version that includes the necessary patch. Regularly updating software packages is essential for maintaining a secure environment.
See every vulnerability recorded for curl →
FAQ
The curl package is an open-source library and command-line tool used for transferring data with URLs. It supports various protocols and provides extensive features for network requests.
The vulnerability in the curl package's ASN.1 parser code can lead to crashes and potentially expose heap contents when certain options are used. It is important to update the package to mitigate these risks.
To fix this vulnerability, update the curl package to a version that includes the necessary patch. Regularly updating software packages is crucial for maintaining security.
No specific workarounds have been provided for this vulnerability. It is recommended to update the curl package to a patched version.
You can find more information about this vulnerability in the provided references: [1] http://www.openwall.com/lists/oss-security/2024/07/31/1, [2] https://curl.se/docs/CVE-2024-7264.html, [3] https://curl.se/docs/CVE-2024-7264.json, [4] https://hackerone.com/reports/2629968
Related vulnerabilities
Recent vulnerabilities recorded for curl.
