Summary
Detail | |||
---|---|---|---|
Vendor | Haxx | First view | 2005-05-02 |
Product | Curl | Last view | 2024-02-03 |
Version | Type | ||
Update | |||
Edition | |||
Language | |||
Sofware Edition | |||
Target Software | |||
Target Hardware | |||
Other |
Activity : Overall
COMMON PLATFORM ENUMERATION: Repartition per Version
Related : CVE
Date | Alert | Description | |
---|---|---|---|
5.3 | 2024-02-03 | CVE-2024-0853 | curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check. |
5.3 | 2023-12-12 | CVE-2023-46219 | When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. |
6.5 | 2023-12-07 | CVE-2023-46218 | This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain. |
7.5 | 2023-09-15 | CVE-2023-38039 | When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory. |
3.3 | 2023-08-22 | CVE-2020-19909 | Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error. |
3.7 | 2023-05-26 | CVE-2023-28322 | An information disclosure vulnerability exists in curl |
5.9 | 2023-05-26 | CVE-2023-28321 | An improper certificate validation vulnerability exists in curl |
5.9 | 2023-05-26 | CVE-2023-28320 | A denial of service vulnerability exists in curl |
7.5 | 2023-05-26 | CVE-2023-28319 | A use after free vulnerability exists in curl |
8.8 | 2023-03-30 | CVE-2023-27534 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user. |
8.8 | 2023-03-30 | CVE-2023-27533 | A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system. |
6.5 | 2023-02-23 | CVE-2023-23916 | An allocation of resources without limits or throttling vulnerability exists in curl |
6.5 | 2023-02-23 | CVE-2023-23915 | A cleartext transmission of sensitive information vulnerability exists in curl |
9.1 | 2023-02-23 | CVE-2023-23914 | A cleartext transmission of sensitive information vulnerability exists in curl |
5.9 | 2023-02-09 | CVE-2022-43552 | A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path. |
7.5 | 2022-12-23 | CVE-2022-43551 | A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded. |
6.5 | 2022-12-05 | CVE-2022-35260 | curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service. |
9.8 | 2022-12-05 | CVE-2022-32221 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST. |
7.5 | 2022-10-29 | CVE-2022-42916 | In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26. |
8.1 | 2022-10-29 | CVE-2022-42915 | curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0. |
3.7 | 2022-09-23 | CVE-2022-35252 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings. |
5.9 | 2022-07-07 | CVE-2022-32208 | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. |
9.8 | 2022-07-07 | CVE-2022-32207 | When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended. |
6.5 | 2022-07-07 | CVE-2022-32206 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. |
4.3 | 2022-07-07 | CVE-2022-32205 | A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
9% (9) | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
7% (7) | CWE-787 | Out-of-bounds Write |
7% (7) | CWE-319 | Cleartext Transmission of Sensitive Information |
7% (7) | CWE-125 | Out-of-bounds Read |
6% (6) | CWE-295 | Certificate Issues |
6% (6) | CWE-20 | Improper Input Validation |
5% (5) | CWE-416 | Use After Free |
4% (4) | CWE-770 | Allocation of Resources Without Limits or Throttling |
4% (4) | CWE-415 | Double Free |
4% (4) | CWE-310 | Cryptographic Issues |
4% (4) | CWE-287 | Improper Authentication |
4% (4) | CWE-200 | Information Exposure |
4% (4) | CWE-190 | Integer Overflow or Wraparound |
3% (3) | CWE-522 | Insufficiently Protected Credentials |
2% (2) | CWE-668 | Exposure of Resource to Wrong Sphere |
2% (2) | CWE-264 | Permissions, Privileges, and Access Controls |
2% (2) | CWE-255 | Credentials Management |
2% (2) | CWE-74 | Failure to Sanitize Data into a Different Plane ('Injection') |
1% (1) | CWE-755 | Improper Handling of Exceptional Conditions |
1% (1) | CWE-706 | Use of Incorrectly-Resolved Name or Reference |
1% (1) | CWE-665 | Improper Initialization |
1% (1) | CWE-476 | NULL Pointer Dereference |
1% (1) | CWE-427 | Uncontrolled Search Path Element |
1% (1) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
1% (1) | CWE-362 | Race Condition |
CAPEC : Common Attack Pattern Enumeration & Classification
id | Name |
---|---|
CAPEC-47 | Buffer Overflow via Parameter Expansion |
CAPEC-100 | Overflow Buffers |
CAPEC-123 | Buffer Attacks |
Oval Markup Language : Definitions
OvalID | Name |
---|---|
oval:org.mitre.oval:def:10273 | Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibl... |
oval:org.mitre.oval:def:19673 | HP-UX Running Java JRE and JDK, Remote Denial of Service (DoS), Unauthorized ... |
oval:org.mitre.oval:def:15241 | DSA-2368-1 lighttpd -- multiple |
oval:org.mitre.oval:def:14752 | SSL and TLS Protocols Vulnerability |
oval:org.mitre.oval:def:18190 | USN-1721-1 -- curl vulnerability |
oval:org.mitre.oval:def:20280 | RHSA-2013:0771: curl security update (Moderate) |
oval:org.mitre.oval:def:20032 | DSA-2660-1 curl - cookie leak vulnerability |
oval:org.mitre.oval:def:18259 | USN-1801-1 -- curl vulnerability |
oval:org.mitre.oval:def:23950 | ELSA-2013:0771: curl security update (Moderate) |
oval:org.mitre.oval:def:23498 | DEPRECATED: ELSA-2013:0771: curl security update (Moderate) |
oval:org.mitre.oval:def:26023 | SUSE-SU-2013:0771-1 -- Security update for curl |
oval:org.mitre.oval:def:25795 | SUSE-SU-2013:0772-1 -- Security update for compat-curl2 |
oval:org.mitre.oval:def:25538 | SUSE-SU-2013:0773-1 -- Security update for curl, curl |
oval:org.mitre.oval:def:27357 | DEPRECATED: ELSA-2013-0771 -- curl security update (moderate) |
oval:org.mitre.oval:def:21195 | RHSA-2013:0983: curl security update (Moderate) |
oval:org.mitre.oval:def:18350 | USN-1894-1 -- curl vulnerability |
oval:org.mitre.oval:def:18308 | DSA-2713-1 curl - heap overflow |
oval:org.mitre.oval:def:23721 | ELSA-2013:0983: curl security update (Moderate) |
oval:org.mitre.oval:def:23483 | DEPRECATED: ELSA-2013:0983: curl security update (Moderate) |
oval:org.mitre.oval:def:25977 | SUSE-SU-2013:1166-1 -- Security update for compat-curl2 |
oval:org.mitre.oval:def:25912 | SUSE-SU-2013:1166-2 -- Security update for curl |
oval:org.mitre.oval:def:27292 | DEPRECATED: ELSA-2013-0983 -- curl security update (moderate) |
oval:org.mitre.oval:def:21073 | USN-2048-1 -- curl vulnerability |
oval:org.mitre.oval:def:19943 | DSA-2798-1 curl - unchecked ssl certificate host name |
oval:org.mitre.oval:def:25586 | SUSE-SU-2014:0004-1 -- Security update for curl |
Open Source Vulnerability Database (OSVDB)
id | Description |
---|---|
74829 | SSL Chained Initialization Vector CBC Mode MiTM Weakness |
14034 | cURL/libcURL Kerberos Authentication Multiple Function Overflows |
14033 | cURL / libcURL NTLM Authentication Curl_input_ntlm() Function Overflow |
ExploitDB Exploits
id | Description |
---|---|
24487 | cURL Buffer Overflow Vulnerability |
OpenVAS Exploits
id | Description |
---|---|
2012-10-19 | Name : Fedora Update for java-1.7.0-openjdk FEDORA-2012-16351 File : nvt/gb_fedora_2012_16351_java-1.7.0-openjdk_fc16.nasl |
2012-10-19 | Name : Fedora Update for java-1.6.0-openjdk FEDORA-2012-16351 File : nvt/gb_fedora_2012_16351_java-1.6.0-openjdk_fc16.nasl |
2012-09-25 | Name : Mac OS X v10.6.8 Multiple Vulnerabilities (2012-004) File : nvt/gb_macosx_su12-004.nasl |
2012-09-22 | Name : Fedora Update for java-1.6.0-openjdk FEDORA-2012-13127 File : nvt/gb_fedora_2012_13127_java-1.6.0-openjdk_fc16.nasl |
2012-09-04 | Name : Fedora Update for java-1.7.0-openjdk FEDORA-2012-13138 File : nvt/gb_fedora_2012_13138_java-1.7.0-openjdk_fc16.nasl |
2012-09-04 | Name : Mandriva Update for fetchmail MDVSA-2012:149 (fetchmail) File : nvt/gb_mandriva_MDVSA_2012_149.nasl |
2012-08-30 | Name : Fedora Update for python3 FEDORA-2012-5785 File : nvt/gb_fedora_2012_5785_python3_fc17.nasl |
2012-08-30 | Name : FreeBSD Ports: fetchmail File : nvt/freebsd_fetchmail16.nasl |
2012-08-30 | Name : Fedora Update for python FEDORA-2012-5892 File : nvt/gb_fedora_2012_5892_python_fc17.nasl |
2012-08-30 | Name : Fedora Update for python-docs FEDORA-2012-5892 File : nvt/gb_fedora_2012_5892_python-docs_fc17.nasl |
2012-08-03 | Name : Mandriva Update for curl MDVSA-2012:058 (curl) File : nvt/gb_mandriva_MDVSA_2012_058.nasl |
2012-07-30 | Name : CentOS Update for firefox CESA-2012:1088 centos6 File : nvt/gb_CESA-2012_1088_firefox_centos6.nasl |
2012-07-30 | Name : CentOS Update for thunderbird CESA-2012:1089 centos6 File : nvt/gb_CESA-2012_1089_thunderbird_centos6.nasl |
2012-07-30 | Name : CentOS Update for thunderbird CESA-2012:1089 centos5 File : nvt/gb_CESA-2012_1089_thunderbird_centos5.nasl |
2012-07-30 | Name : CentOS Update for firefox CESA-2012:1088 centos5 File : nvt/gb_CESA-2012_1088_firefox_centos5.nasl |
2012-07-30 | Name : CentOS Update for java CESA-2011:1380 centos5 x86_64 File : nvt/gb_CESA-2011_1380_java_centos5_x86_64.nasl |
2012-07-19 | Name : RedHat Update for firefox RHSA-2012:1088-01 File : nvt/gb_RHSA-2012_1088-01_firefox.nasl |
2012-07-19 | Name : RedHat Update for thunderbird RHSA-2012:1089-01 File : nvt/gb_RHSA-2012_1089-01_thunderbird.nasl |
2012-06-22 | Name : Mandriva Update for python MDVSA-2012:096 (python) File : nvt/gb_mandriva_MDVSA_2012_096.nasl |
2012-06-22 | Name : Mandriva Update for python MDVSA-2012:097 (python) File : nvt/gb_mandriva_MDVSA_2012_097.nasl |
2012-06-22 | Name : Fedora Update for python3 FEDORA-2012-9135 File : nvt/gb_fedora_2012_9135_python3_fc16.nasl |
2012-06-19 | Name : Fedora Update for java-1.6.0-openjdk FEDORA-2012-9545 File : nvt/gb_fedora_2012_9545_java-1.6.0-openjdk_fc16.nasl |
2012-06-19 | Name : Fedora Update for java-1.6.0-openjdk FEDORA-2012-9541 File : nvt/gb_fedora_2012_9541_java-1.6.0-openjdk_fc15.nasl |
2012-06-19 | Name : Fedora Update for java-1.7.0-openjdk FEDORA-2012-9593 File : nvt/gb_fedora_2012_9593_java-1.7.0-openjdk_fc16.nasl |
2012-05-18 | Name : Mac OS X Multiple Vulnerabilities (2012-002) File : nvt/gb_macosx_su12-002.nasl |
Information Assurance Vulnerability Management (IAVM)
id | Description |
---|---|
2015-A-0199 | Multiple Vulnerabilities in Apple Mac OS X Severity: Category I - VMSKEY: V0061337 |
2014-B-0161 | Multiple Vulnerabilities in VMware ESXi 5.1 Severity: Category I - VMSKEY: V0057717 |
2014-A-0030 | Apple Mac OS X Security Update 2014-001 Severity: Category I - VMSKEY: V0044547 |
2013-A-0199 | Multiple Vulnerabilities in Oracle Fusion Middleware Severity: Category I - VMSKEY: V0040786 |
2012-A-0048 | Multiple Vulnerabilities in VMware vCenter Update Manager 5.0 Severity: Category I - VMSKEY: V0031901 |
2012-B-0006 | Microsoft SSL/TLS Information Disclosure Vulnerability Severity: Category I - VMSKEY: V0031054 |
Snort® IPS/IDS
Date | Description |
---|---|
2017-04-12 | cURL and libcurl set-cookie remote code execution attempt RuleID : 41853 - Type : OS-LINUX - Revision : 4 |
2014-01-10 | libcurl MD5 digest buffer overflow attempt RuleID : 26391 - Type : PROTOCOL-POP - Revision : 3 |
2014-01-10 | SSL CBC encryption mode weakness brute force attempt RuleID : 20212 - Type : SERVER-OTHER - Revision : 11 |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2019-01-10 | Name: The remote Amazon Linux 2 host is missing a security update. File: al2_ALAS-2019-1139.nasl - Type: ACT_GATHER_INFO |
2019-01-08 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2019-1002.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-298a3d2923.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-57779d51c1.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-69bac0f51c.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-7785911c9e.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-bc65ab5014.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-fa01002d7e.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-fdc4ca8675.nasl - Type: ACT_GATHER_INFO |
2018-12-28 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2018-1427.nasl - Type: ACT_GATHER_INFO |
2018-12-20 | Name: The remote Amazon Linux 2 host is missing a security update. File: al2_ALAS-2018-1135.nasl - Type: ACT_GATHER_INFO |
2018-12-10 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2018-1401.nasl - Type: ACT_GATHER_INFO |
2018-12-07 | Name: The remote Amazon Linux AMI host is missing a security update. File: ala_ALAS-2018-1112.nasl - Type: ACT_GATHER_INFO |
2018-11-16 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2018-3157.nasl - Type: ACT_GATHER_INFO |
2018-11-07 | Name: The remote Debian host is missing a security update. File: debian_DLA-1568.nasl - Type: ACT_GATHER_INFO |
2018-11-05 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-4331.nasl - Type: ACT_GATHER_INFO |
2018-11-02 | Name: The remote FreeBSD host is missing a security-related update. File: freebsd_pkg_e0ab177307c146c691704c5e81c00927.nasl - Type: ACT_GATHER_INFO |
2018-11-01 | Name: The remote Slackware host is missing a security update. File: Slackware_SSA_2018-304-01.nasl - Type: ACT_GATHER_INFO |
2018-10-26 | Name: The remote EulerOS Virtualization host is missing multiple security updates. File: EulerOS_SA-2018-1330.nasl - Type: ACT_GATHER_INFO |
2018-09-21 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2018-1_0-0186.nasl - Type: ACT_GATHER_INFO |
2018-09-21 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2018-2_0-0096.nasl - Type: ACT_GATHER_INFO |
2018-09-06 | Name: The remote FreeBSD host is missing a security-related update. File: freebsd_pkg_f4d638b9e6e54dbe8c70571dbc116174.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2017-0045.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2017-1_0-0095.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2018-1_0-0108.nasl - Type: ACT_GATHER_INFO |