cURL - Cookie Information Leakage
Summary
DSA-3022-1: curl - security update. Affects curl versions < 7.26.0-1+wheezy10. Fixed in 7.26.0-1+wheezy10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cURL is an URL transfer library used for making HTTP requests and transferring data. It is widely used in various applications and programming languages. However, two vulnerabilities have been discovered in cURL that can lead to the leakage of cookie information. These vulnerabilities can allow cookies to be sent to wrong sites or arbitrary sites to set cookies for others, potentially compromising user privacy and security.
Vulnerability Detail
The first vulnerability, CVE-2014-3613, occurs due to the improper detection and rejection of domain names for partial literal IP addresses when parsing received HTTP cookies. This allows malicious actors to trick libcurl into sending cookies to wrong sites and allowing arbitrary sites to set cookies for others. The second vulnerability, CVE-2014-3620, arises from libcurl wrongly allowing cookies to be set for Top Level Domains (TLDs), extending their scope beyond what is allowed. This enables arbitrary sites to set cookies that would then be sent to a different and unrelated site or domain.
How To Fix
Minimum fixed version
7.26.0-1+wheezy10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for these vulnerabilities. It is crucial to apply the recommended fix by upgrading the curl packages to the patched versions.
Conclusion
Two vulnerabilities have been discovered in cURL that can lead to the leakage of cookie information. It is crucial to upgrade the curl packages to the recommended versions to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
cURL is an URL transfer library used for making HTTP requests and transferring data.
The vulnerabilities in cURL are CVE-2014-3613 and CVE-2014-3620, which can lead to the leakage of cookie information.
These vulnerabilities can allow cookies to be sent to wrong sites or arbitrary sites to set cookies for others, compromising user privacy and security.
To fix these vulnerabilities, upgrade the curl packages to the recommended versions provided in the advisory.
No specific workaround is mentioned. It is important to apply the recommended fix by upgrading the curl packages.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
