libcurl supports HTTP "cookies" as documented in RFC 6265. Together with each
individual cookie there are several different properties, but for this
vulnerability we focus on the associated "path" element. It tells information
about for which path on a given host the cookies is valid.
The internal libcurl function called `sanitize_cookie_path()` that cleans up
the path element as given to it from a remote site or when read from a file,
did not properly validate the input. If given a path that consisted of a
single double-quote, libcurl would index a newly allocated memory area with
index -1 and assign a zero to it, thus destroying heap memory it wasn't
At best, this gets unnoticed but can also lead to a crash or worse. We have
not researched further what kind of malicious actions that potentially this
could be used for.
Applications have to explicitly enable cookie parsing in libcurl for this
problem to trigger, and if not enabled libcurl will not hit this problem.
We are not aware of any exploits of this flaw.
Affected versions: from libcurl 7.31.0 to and including 7.41.0
Red Hat would like to thank Daniel Stenberg (curl upstream) for reporting this issue. Upstream acknowledges Hanno Böck as the original reporter.
Created curl tracking bugs for this issue:
Affects: fedora-all [bug 1214182]
Created mingw-curl tracking bugs for this issue:
Affects: fedora-all [bug 1214795]
Affects: epel-7 [bug 1214796]
Not vulnerable. This issue does not affect the version of curl as shipped with Red Hat Enterprise Linux 5, 6 and 7.
curl-7.40.0-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
curl-7.32.0-20.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
curl-7.37.0-14.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.