Bug 1536013 (CVE-2018-1000005) - CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers
Summary: CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-1000005
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1536014 1699816 1699817
Blocks: 1696275
TreeView+ depends on / blocked
 
Reported: 2018-01-18 12:55 UTC by Adam Mariš
Modified: 2019-09-29 14:30 UTC (History)
17 users (show)

Fixed In Version: curl 7.58.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-07-12 13:04:58 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1543 None None None 2019-06-18 19:09:05 UTC

Description Adam Mariš 2018-01-18 12:55:47 UTC
An out-of-bounds read in code handling HTTP/2 trailers was found. This could lead to a denial-of-service or an information disclosure in some circumstances.

Affected versions: libcurl 7.49.0 to and including 7.57.0
Not affected versions: libcurl < 7.49.0 and >= 7.58.0

Upstream bug report:

https://github.com/curl/curl/pull/2231

Upstream patch:

https://github.com/curl/curl/commit/fa3dbb9a147488a294.patch

Comment 1 Adam Mariš 2018-01-18 12:55:51 UTC
Acknowledgments:

Name: the Curl project
Upstream: Zhouyihai Ding

Comment 3 Adam Mariš 2018-01-24 08:11:28 UTC
External References:

https://curl.haxx.se/docs/adv_2018-824a.html

Comment 6 Hardik Vyas 2019-04-10 10:50:13 UTC
The latest version of curl shipped by ceph-2 is 7.29.0-32.el7(~3 years back), however which is not affected by this flaw. Ceph-2 no more ships updated version of curl and consumes latest available releases from RHEL repo.

Comment 8 Huzaifa S. Sidhpurwala 2019-04-15 06:39:58 UTC
This bug was essentially introduced by the following commit:
https://github.com/curl/curl/commit/0761a51ee0551ad9e5

Comment 9 Huzaifa S. Sidhpurwala 2019-04-15 06:40:06 UTC
Statement:

This flaw was introduced in curl-7.49.0. Therefore the versions of curl shipped with Red Hat Enterprise Linux 5, 6 and 7 and Red Hat Ceph Storage 2 are not affected by this flaw.

Comment 10 Joshua Padman 2019-04-15 10:01:53 UTC
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1699816]


Created mingw-curl tracking bugs for this issue:

Affects: fedora-all [bug 1699817]

Comment 11 errata-xmlrpc 2019-06-18 19:09:04 UTC
This issue has been addressed in the following products:

  JBoss Core Services Apache HTTP Server 2.4.29 SP2

Via RHSA-2019:1543 https://access.redhat.com/errata/RHSA-2019:1543

Comment 12 Product Security DevOps Team 2019-07-12 13:04:58 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-1000005


Note You need to log in before you can comment on or make changes to this bug.