Bug 1536013 (CVE-2018-1000005)

Summary: CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: csutherl, erik-fedora, gzaronik, hhorak, java-maint, jclere, john.j5live, jorton, kdudka, mbabacek, mike, mturk, omajid, paul, security-response-team, sisharma, twalsh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: curl 7.58.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-12 13:04:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1536014, 1699816, 1699817    
Bug Blocks: 1696275    

Description Adam Mariš 2018-01-18 12:55:47 UTC
An out-of-bounds read in code handling HTTP/2 trailers was found. This could lead to a denial-of-service or an information disclosure in some circumstances.

Affected versions: libcurl 7.49.0 to and including 7.57.0
Not affected versions: libcurl < 7.49.0 and >= 7.58.0

Upstream bug report:

https://github.com/curl/curl/pull/2231

Upstream patch:

https://github.com/curl/curl/commit/fa3dbb9a147488a294.patch

Comment 1 Adam Mariš 2018-01-18 12:55:51 UTC
Acknowledgments:

Name: the Curl project
Upstream: Zhouyihai Ding

Comment 3 Adam Mariš 2018-01-24 08:11:28 UTC
External References:

https://curl.haxx.se/docs/adv_2018-824a.html

Comment 6 Hardik Vyas 2019-04-10 10:50:13 UTC
The latest version of curl shipped by ceph-2 is 7.29.0-32.el7(~3 years back), however which is not affected by this flaw. Ceph-2 no more ships updated version of curl and consumes latest available releases from RHEL repo.

Comment 8 Huzaifa S. Sidhpurwala 2019-04-15 06:39:58 UTC
This bug was essentially introduced by the following commit:
https://github.com/curl/curl/commit/0761a51ee0551ad9e5

Comment 9 Huzaifa S. Sidhpurwala 2019-04-15 06:40:06 UTC
Statement:

This flaw was introduced in curl-7.49.0. Therefore the versions of curl shipped with Red Hat Enterprise Linux 5, 6 and 7 and Red Hat Ceph Storage 2 are not affected by this flaw.

Comment 10 Joshua Padman 2019-04-15 10:01:53 UTC
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1699816]


Created mingw-curl tracking bugs for this issue:

Affects: fedora-all [bug 1699817]

Comment 11 errata-xmlrpc 2019-06-18 19:09:04 UTC
This issue has been addressed in the following products:

  JBoss Core Services Apache HTTP Server 2.4.29 SP2

Via RHSA-2019:1543 https://access.redhat.com/errata/RHSA-2019:1543

Comment 12 Product Security DevOps Team 2019-07-12 13:04:58 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-1000005