Buffer Over-read Vulnerability in curl
Summary
CVE-2018-1000122: A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage. Affects curl across 2 version ranges.
< 7.59.0-r0
< 61c434273654048462873c031eda027dd4acd549
Fixed in 7.59.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, FTP, and RTSP. The vulnerability, known as CVE-2018-1000122, affects curl versions 7.20.0 to 7.58.0. It involves a buffer over-read in the RTSP+RTP handling code, which can lead to a denial of service or information leakage.
Vulnerability Detail
The buffer over-read vulnerability in curl allows an attacker to exploit the RTSP+RTP handling code, potentially causing a denial of service or leaking sensitive information. By sending specially crafted requests, an attacker can trigger the vulnerability and compromise the integrity and availability of the affected system. The vulnerability has a CVSS score of 9.1, indicating a high severity level.
How To Fix
Minimum fixed version
7.59.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to update to the fixed version of curl as soon as possible.
Conclusion
The buffer over-read vulnerability in curl can have serious consequences, including denial of service and information leakage. It is crucial to update to the fixed version of curl (7.59.0-r0 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
Curl is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, FTP, and RTSP.
The vulnerability can lead to a denial of service or information leakage, potentially compromising the integrity and availability of the affected system.
The CVSS score of this vulnerability is 9.1, indicating a high severity level.
To fix this vulnerability, update curl to version 7.59.0-r0 or later.
No specific workaround has been provided. It is recommended to update to the fixed version of curl.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
