libcurl supports HTTP "cookies" as documented in RFC 6265. Together with each individual cookie there are several different properties, but for this vulnerability we focus on the associated "path" element. It tells information about for which path on a given host the cookies is valid. The internal libcurl function called `sanitize_cookie_path()` that cleans up the path element as given to it from a remote site or when read from a file, did not properly validate the input. If given a path that consisted of a single double-quote, libcurl would index a newly allocated memory area with index -1 and assign a zero to it, thus destroying heap memory it wasn't supposed to. At best, this gets unnoticed but can also lead to a crash or worse. We have not researched further what kind of malicious actions that potentially this could be used for. Applications have to explicitly enable cookie parsing in libcurl for this problem to trigger, and if not enabled libcurl will not hit this problem. We are not aware of any exploits of this flaw. Affected versions: from libcurl 7.31.0 to and including 7.41.0 Acknowledgements: Red Hat would like to thank Daniel Stenberg (curl upstream) for reporting this issue. Upstream acknowledges Hanno Böck as the original reporter.
External References: http://curl.haxx.se/docs/adv_20150422C.html
Created curl tracking bugs for this issue: Affects: fedora-all [bug 1214182]
Created mingw-curl tracking bugs for this issue: Affects: fedora-all [bug 1214795] Affects: epel-7 [bug 1214796]
Patch: http://curl.haxx.se/CVE-2015-3145.patch
Statement: Not vulnerable. This issue does not affect the version of curl as shipped with Red Hat Enterprise Linux 5, 6 and 7.
Upstream commit: https://github.com/bagder/curl/commit/b5f947b8ac0e282c61c75b69cd5b9d37dafc6959
curl-7.40.0-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
curl-7.32.0-20.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
curl-7.37.0-14.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.