Critical Out-of-Bounds Read Vulnerability in curl Package
Summary
ALPINE-CVE-2018-1000005: libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. Affects curl versions < 7.58.0-r0. Fixed in 7.58.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more. curl is essential for developers and system administrators for tasks such as downloading files, making API requests, and automating web interactions. However, versions 7.49.0 to 7.57.0 are vulnerable to an out-of-bounds read issue that can lead to severe security implications.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2018-1000005 affects curl versions 7.49.0 through 7.57.0. It arises from improper handling of HTTP/2 trailers, where the stored size was incorrectly calculated, leading to potential out-of-bounds reads. This flaw can cause crashes or allow excessive data to be sent to clients, resulting in denial-of-service attacks or information disclosure. The issue was reported on GitHub and highlights the critical need for secure data handling in network protocols.
How To Fix
Minimum fixed version
7.58.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the curl package immediately, consider disabling HTTP/2 support in your applications or using an alternative method for data transfer that does not rely on curl until the update can be applied.
Conclusion
The out-of-bounds read vulnerability in the curl package poses significant risks to applications that rely on it for data transfer. It is crucial to update to the patched version to mitigate these risks. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for curl →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
The affected versions of curl are from 7.49.0 to 7.57.0.
The potential consequences include denial-of-service attacks and information disclosure, which can compromise the security of applications using the affected curl versions.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to access the code.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
