Heap Out-of-Bounds Read in Curl Package - CVE-2019-3823
Summary
ALPINE-CVE-2019-3823: libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. Affects curl versions < 7.64.0-r0. Fixed in 7.64.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and SMTP. The package is essential for applications that require data transfer over the internet. However, certain versions of Curl are vulnerable to a heap out-of-bounds read, which can lead to potential security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2019-3823, affects libcurl versions from 7.34.0 to before 7.64.0. It arises from improper handling of the end-of-response for SMTP, where a non-NUL terminated buffer can cause the strtol() function to read beyond the allocated memory. This can lead to information leakage or application crashes, posing a significant risk to systems relying on affected versions of Curl.
How To Fix
Minimum fixed version
7.64.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any buffer passed to the smtp_endofresp() function is properly NUL terminated and does not exceed the expected length. This can help mitigate the risk until the package is updated.
Conclusion
CVE-2019-3823 represents a significant security risk for applications using vulnerable versions of Curl. It is crucial to update to the patched version to mitigate potential threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for curl →
FAQ
CVE-2019-3823 is a vulnerability in the Curl package that allows for a heap out-of-bounds read, potentially leading to information leakage.
Curl versions from 7.34.0 to before 7.64.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-3823 is 7.5, indicating a high severity level.
If an immediate update is not possible, ensure that any buffers passed to the vulnerable functions are properly managed to prevent out-of-bounds reads.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
