Integer Overflow Vulnerability in curl Package Leading to Buffer Overflow
Summary
ALPINE-CVE-2019-5435: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. Affects curl versions < 7.65.0-r0. Fixed in 7.65.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package is a widely used command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more, making it essential for web communication and data retrieval. The curl library, known as libcurl, is utilized in numerous applications and systems due to its versatility and reliability. However, it is susceptible to vulnerabilities, including the recent integer overflow issue that can lead to serious security risks.
Vulnerability Detail
An integer overflow in curl's URL API results in a buffer overflow in libcurl versions 7.62.0 to 7.64.1. This vulnerability arises from improper handling of input data, allowing attackers to exploit the overflow and potentially execute arbitrary code or crash the application. The ramifications of this vulnerability can be severe, affecting the integrity and availability of systems relying on the affected versions of curl.
How To Fix
Minimum fixed version
7.65.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input data size to the curl URL API to prevent the overflow from occurring. However, this is not a permanent solution and updating to the patched version is strongly recommended.
Conclusion
The integer overflow vulnerability in the curl package poses a significant risk to applications relying on affected versions. It is crucial to update to the patched version to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your software.
See every vulnerability recorded for curl →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a moderate level of severity.
The affected versions of curl are from 7.62.0 to 7.64.1.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include arbitrary code execution, application crashes, and compromised system integrity.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
