Critical Stack Overflow Vulnerability in curl Package
Summary
ALPINE-CVE-2020-8285: curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. Affects curl versions < 7.66.0-r3. Fixed in 7.66.0-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more, making it essential for web communication and data transfer. This package is integral to many applications and systems, providing a reliable way to interact with web services. However, certain versions of curl are vulnerable to a stack overflow issue that can lead to severe security risks.
Vulnerability Detail
The vulnerability in question affects curl versions 7.21.0 through 7.73.0, where an uncontrolled recursion occurs during FTP wildcard match parsing. This flaw can lead to a stack overflow, potentially allowing an attacker to execute arbitrary code or crash the application. The root cause lies in the way curl processes FTP requests, making it susceptible to crafted input that triggers excessive recursion.
How To Fix
Minimum fixed version
7.66.0-r3
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using FTP wildcard matching in curl commands until the package is updated. This can be done by specifying exact file names instead of using wildcards.
Conclusion
The stack overflow vulnerability in the curl package poses significant risks to applications relying on this tool for data transfer. It is crucial to update to the latest patched versions to mitigate these risks. Users should also consider using Vulert for real-time monitoring of vulnerabilities in their software.
See every vulnerability recorded for curl →
FAQ
curl versions from 7.21.0 to 7.73.0 are affected by this stack overflow vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update curl right away, avoid using FTP wildcard matching in your commands as a temporary workaround.
More information can be found in the CVE database or by visiting the official curl website for security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
