Critical Denial of Service Vulnerability in curl: CVE-2017-8817
Summary
ALPINE-CVE-2017-8817: The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends... Affects curl versions < 7.57.0-r0. Fixed in 7.57.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, FTP, and more. curl is integral for developers and system administrators for tasks such as downloading files, making API requests, and automating data transfers. However, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The FTP wildcard function in curl and libcurl versions prior to 7.57.0 is vulnerable to a denial of service attack. This vulnerability allows remote attackers to exploit a string that ends with an '[' character, leading to an out-of-bounds read and potential application crash. The ramifications of this vulnerability can include service interruptions and the possibility of further exploitation, making it critical to address promptly.
How To Fix
Minimum fixed version
7.57.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using FTP wildcard functions in curl until the package can be updated. This can help prevent potential exploitation while a permanent fix is being implemented.
Conclusion
CVE-2017-8817 is a critical vulnerability in curl that poses significant risks, including denial of service. It is essential to update to the patched version to ensure the security and stability of applications using curl. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for curl →
FAQ
CVE-2017-8817 is a vulnerability in curl that allows for denial of service attacks through an out-of-bounds read.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-8817 is 9.8, indicating a critical severity level.
If an immediate update is not possible, refrain from using FTP wildcard functions in curl as a temporary workaround.
You can find more information about curl vulnerabilities on the official curl website and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
