Bug 1794143 (CVE-2019-15601) - CVE-2019-15601 curl: improper input validation allows users to create a 'FILE:' URL that can make the client access a remote file using SMB
Summary: CVE-2019-15601 curl: improper input validation allows users to create a 'FILE...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-15601
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1794144
TreeView+ depends on / blocked
 
Reported: 2020-01-22 18:47 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-03-24 16:49 UTC (History)
27 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-02-04 18:59:31 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-01-22 18:47:27 UTC 
CURL before 7.68.0 lacks proper input validation, which allows users to create a `FILE:` URL that can make the client access a remote file using SMB (Windows-only issue).

Reference:
https://www.openwall.com/lists/oss-security/2020/01/08/1

Upstream commit:
https://github.com/curl/curl/commit/1b71bc532bde8621fd3260843f8197182a467ff2
Comment 1 Marco Benatto 2020-02-04 18:59:31 UTC 
As stated at https://www.openwall.com/lists/oss-security/2020/01/08/1 this issue affects only Windows.
Closing this as NOTABUG.
Note You need to log in before you can comment on or make changes to this bug.