Heap-Based Buffer Over-Read Vulnerability in Curl Package
Summary
ALPINE-CVE-2018-16842: Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. Affects curl versions < 7.62.0-r0. Fixed in 7.62.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more, making it essential for web-related tasks. The package is known for its versatility and ease of use, but it has been found to be vulnerable to a specific issue that can lead to information exposure and denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2018-16842 affects Curl versions 7.14.1 through 7.61.1. It is a heap-based buffer over-read in the tool_msgs.c:voutf() function. This flaw can allow an attacker to exploit the vulnerability, potentially leading to information exposure or a denial of service. The issue arises from improper handling of memory, which can be exploited to read beyond the allocated buffer, exposing sensitive information.
How To Fix
Minimum fixed version
7.62.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the Curl package immediately, consider limiting the exposure of your application by restricting access to the affected functionalities or using alternative methods for data transfer that do not rely on the vulnerable version of Curl.
Conclusion
The vulnerability CVE-2018-16842 in Curl poses significant risks, including potential information exposure and denial of service. It is crucial to update to the patched version 7.62.0-r0 or later to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for curl →
FAQ
CVE-2018-16842 is a vulnerability in Curl that allows for a heap-based buffer over-read, potentially leading to information exposure and denial of service.
Curl versions 7.14.1 through 7.61.1 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 9.1, indicating a critical level of severity.
If you cannot update Curl, consider implementing access restrictions to the affected functionalities or using alternative data transfer methods.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
