Bug 1138846 (CVE-2014-3620)

Summary:	CVE-2014-3620 curl: cookies accepted for TLDs
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kdudka, mmcallis, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	curl 7.38.0	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-09-15 12:04:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1140037, 1140038, 1140039
Bug Blocks:	1136155

Description Vincent Danen 2014-09-05 18:57:53 UTC

Daniel Stenberg reported the following vulnerability in cURL that could cause libcurl-based HTTP clients to leak cookie information:

Cookies set for Top Level Domains (TLD)

   libcurl wrongly allows cookies to be set for TLDs, thus making them much
   broader then they are supposed to be allowed to. This can allow arbitrary
   sites to set cookies that then would get sent to a different and unrelated
   site or domain.

   INFO

   Cookie parsing and use is opt-in by applications and is not enabled by
   default.

   libcurl's cookie parser has no Public Suffix awareness, so apart from
   rejecting TLDs from being allowed it might still allow cookies for domains
   that are otherwise widely rejected by ordinary browsers. See
   https://publicsuffix.org/ for details.

Versions 7.31.0 and later are affected.  Earlier versions are not affected.

Information about how to enable cookies is available from http://curl.haxx.se/docs/http-cookies.html

Acknowledgements:

Red Hat would like to thank the cURL project for reporting these issues. Upstream acknowledges Tim Ruehsen as the original reporter.


Statement:

This issue did not affect the versions of curl as shipped with Red Hat Enterprise Linux 5, 6, or 7.

Comment 1 Tomas Hoger 2014-09-08 13:43:14 UTC

(In reply to Vincent Danen from comment #0)
> Versions 7.31.0 and later are affected.  Earlier versions are not affected.

To be more specific, upstream identified the following commit as the one that introduced this issue and caused curl to accept cookies for TLDs:

https://github.com/bagder/curl/commit/85b9dc8023

This fix was also backported to curl version 7.29.0 as used in Fedora 19.  Hence all current Fedora releases are affected by this problem.

Red Hat Enterprise Linux 5, 6 and 7 are not affected, as noted above.

Comment 4 Murray McAllister 2014-09-10 08:29:04 UTC

This issue is public now.

External References:

http://curl.haxx.se/docs/adv_20140910B.html

Comment 5 Murray McAllister 2014-09-10 08:35:42 UTC

Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1140039]

Comment 6 Murray McAllister 2014-09-10 08:35:45 UTC

Created mingw-curl tracking bugs for this issue:

Affects: fedora-all [bug 1140037]
Affects: epel-7 [bug 1140038]

Comment 7 Fedora Update System 2014-09-14 03:27:25 UTC

curl-7.32.0-13.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2014-09-23 04:26:08 UTC

curl-7.37.0-7.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2014-10-08 19:03:39 UTC

curl-7.29.0-23.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.