Heap Buffer Overflow Vulnerability in curl Package: CVE-2019-5436
Summary
ALPINE-CVE-2019-5436: A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. Affects curl versions < 7.65.0-r0. Fixed in 7.65.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and TFTP. The curl library is integral for applications that require data transfer capabilities. However, certain versions of curl are vulnerable to a heap buffer overflow, which can lead to severe security issues.
Vulnerability Detail
A heap buffer overflow in the TFTP receiving code of libcurl versions 7.19.4 through 7.64.1 allows for denial of service (DoS) attacks or arbitrary code execution. This vulnerability arises from improper handling of data during TFTP operations, which can be exploited by attackers to execute malicious code or crash the application. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
7.65.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider disabling TFTP support in your application or using an alternative method for file transfers that does not involve TFTP.
Conclusion
The CVE-2019-5436 vulnerability in the curl package poses significant risks due to its potential for arbitrary code execution and denial of service. It is crucial for users of affected versions to update to the patched version promptly to mitigate these risks.
See every vulnerability recorded for curl →
FAQ
CVE-2019-5436 is a vulnerability in the curl package that allows for a heap buffer overflow, potentially leading to DoS or arbitrary code execution.
The affected versions of curl are from 7.19.4 through 7.64.1.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider disabling TFTP support in your application or using alternative file transfer methods until you can update.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, ensuring real-time awareness of potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
