Bug 2241933 (CVE-2023-38545) - CVE-2023-38545 curl: heap based buffer overflow in the SOCKS5 proxy handshake
Summary: CVE-2023-38545 curl: heap based buffer overflow in the SOCKS5 proxy handshake
Keywords:
Status: NEW
Alias: CVE-2023-38545
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2245215 2245216 2243182 2245214 2245217 2249884
Blocks: 2241927
TreeView+ depends on / blocked
 
Reported: 2023-10-03 13:54 UTC by Marian Rehak
Modified: 2024-04-23 17:26 UTC (History)
29 users (show)

Fixed In Version: curl 8.4.0
Doc Type: If docs needed, set a value
Doc Text:
A heap-based buffer overflow flaw was found in the SOCKS5 proxy handshake in the Curl package. If Curl is unable to resolve the address itself, it passes the hostname to the SOCKS5 proxy. However, the maximum length of the hostname that can be passed is 255 bytes. If the hostname is longer, then Curl switches to the local name resolving and passes the resolved address only to the proxy. The local variable that instructs Curl to "let the host resolve the name" could obtain the wrong value during a slow SOCKS5 handshake, resulting in the too-long hostname being copied to the target buffer instead of the resolved address, which was not the intended behavior.
Clone Of:
Environment:
Last Closed:
Embargoed:
ytale: needinfo-

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:5827 0 None None None 2023-10-18 04:00:12 UTC
Red Hat Product Errata RHBA-2023:5828 0 None None None 2023-10-18 04:04:10 UTC
Red Hat Product Errata RHBA-2023:5829 0 None None None 2023-10-18 04:07:07 UTC
Red Hat Product Errata RHBA-2023:5830 0 None None None 2023-10-18 04:09:54 UTC
Red Hat Product Errata RHBA-2023:5832 0 None None None 2023-10-18 07:41:12 UTC
Red Hat Product Errata RHBA-2023:5833 0 None None None 2023-10-18 07:47:08 UTC
Red Hat Product Errata RHBA-2023:5834 0 None None None 2023-10-18 07:49:02 UTC
Red Hat Product Errata RHBA-2023:5839 0 None None None 2023-10-18 10:24:55 UTC
Red Hat Product Errata RHBA-2023:5842 0 None None None 2023-10-18 10:36:20 UTC
Red Hat Product Errata RHBA-2023:5843 0 None None None 2023-10-18 11:14:17 UTC
Red Hat Product Errata RHBA-2023:5846 0 None None None 2023-10-18 14:08:45 UTC
Red Hat Product Errata RHBA-2023:5847 0 None None None 2023-10-18 14:08:48 UTC
Red Hat Product Errata RHBA-2023:5870 0 None None None 2023-10-18 22:54:50 UTC
Red Hat Product Errata RHBA-2023:5899 0 None None None 2023-10-19 07:02:53 UTC
Red Hat Product Errata RHBA-2023:5907 0 None None None 2023-10-19 08:30:57 UTC
Red Hat Product Errata RHBA-2023:5908 0 None None None 2023-10-19 08:46:19 UTC
Red Hat Product Errata RHBA-2023:5909 0 None None None 2023-10-19 08:55:59 UTC
Red Hat Product Errata RHBA-2023:5911 0 None None None 2023-10-19 09:04:18 UTC
Red Hat Product Errata RHBA-2023:5912 0 None None None 2023-10-19 09:07:46 UTC
Red Hat Product Errata RHBA-2023:5913 0 None None None 2023-10-19 09:07:55 UTC
Red Hat Product Errata RHBA-2023:5914 0 None None None 2023-10-19 09:11:31 UTC
Red Hat Product Errata RHBA-2023:5955 0 None None None 2023-10-20 09:08:28 UTC
Red Hat Product Errata RHBA-2023:6076 0 None None None 2023-10-24 11:47:58 UTC
Red Hat Product Errata RHBA-2023:6867 0 None None None 2023-11-09 19:24:26 UTC
Red Hat Product Errata RHBA-2023:6868 0 None None None 2023-11-09 19:28:33 UTC
Red Hat Product Errata RHBA-2023:6869 0 None None None 2023-11-09 19:31:55 UTC
Red Hat Product Errata RHBA-2023:6870 0 None None None 2023-11-09 19:35:10 UTC
Red Hat Product Errata RHBA-2023:6871 0 None None None 2023-11-09 19:34:59 UTC
Red Hat Product Errata RHBA-2023:6872 0 None None None 2023-11-09 19:35:21 UTC
Red Hat Product Errata RHBA-2023:6873 0 None None None 2023-11-09 19:38:08 UTC
Red Hat Product Errata RHBA-2023:6874 0 None None None 2023-11-09 19:38:17 UTC
Red Hat Product Errata RHBA-2023:6880 0 None None None 2023-11-13 00:27:40 UTC
Red Hat Product Errata RHBA-2023:7223 0 None None None 2023-11-15 01:37:32 UTC
Red Hat Product Errata RHBA-2023:7225 0 None None None 2023-11-16 07:06:13 UTC
Red Hat Product Errata RHBA-2023:7226 0 None None None 2023-11-15 08:25:00 UTC
Red Hat Product Errata RHBA-2023:7227 0 None None None 2023-11-16 07:06:22 UTC
Red Hat Product Errata RHBA-2023:7228 0 None None None 2023-11-16 07:05:59 UTC
Red Hat Product Errata RHBA-2023:7229 0 None None None 2023-11-16 07:06:33 UTC
Red Hat Product Errata RHBA-2023:7266 0 None None None 2023-11-15 18:20:30 UTC
Red Hat Product Errata RHBA-2023:7280 0 None None None 2023-11-15 19:14:49 UTC
Red Hat Product Errata RHBA-2023:7646 0 None None None 2023-12-05 00:07:20 UTC
Red Hat Product Errata RHSA-2023:5700 0 None None None 2023-10-13 21:46:44 UTC
Red Hat Product Errata RHSA-2023:5763 0 None None None 2023-10-17 08:58:32 UTC
Red Hat Product Errata RHSA-2023:6745 0 None None None 2023-11-07 10:27:10 UTC
Red Hat Product Errata RHSA-2023:7625 0 None None None 2023-12-07 13:49:36 UTC
Red Hat Product Errata RHSA-2023:7626 0 None None None 2023-12-07 13:55:46 UTC
Red Hat Product Errata RHSA-2024:0797 0 None None None 2024-02-13 14:43:16 UTC
Red Hat Product Errata RHSA-2024:2011 0 None None None 2024-04-23 17:26:29 UTC

Description Marian Rehak 2023-10-03 13:54:40 UTC 
When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only to the proxy. Due to a bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there.
Comment 4 Marian Rehak 2023-10-11 06:54:28 UTC 
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 2243182]
Comment 5 errata-xmlrpc 2023-10-13 21:46:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:5700 https://access.redhat.com/errata/RHSA-2023:5700
Comment 6 Fedora Update System 2023-10-14 01:31:43 UTC 
FEDORA-2023-b855de5c0f has been pushed to the Fedora 38 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 7 errata-xmlrpc 2023-10-17 08:58:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:5763 https://access.redhat.com/errata/RHSA-2023:5763
Comment 9 Fedora Update System 2023-10-28 01:25:12 UTC 
FEDORA-2023-fef2b8da32 has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 11 errata-xmlrpc 2023-11-07 10:27:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6745 https://access.redhat.com/errata/RHSA-2023:6745
Comment 21 errata-xmlrpc 2023-12-07 13:49:33 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2023:7625 https://access.redhat.com/errata/RHSA-2023:7625
Comment 22 errata-xmlrpc 2023-12-07 13:55:44 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2023:7626 https://access.redhat.com/errata/RHSA-2023:7626
Comment 31 errata-xmlrpc 2024-02-13 14:43:14 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.14 for RHEL 8

Via RHSA-2024:0797 https://access.redhat.com/errata/RHSA-2024:0797
Comment 32 errata-xmlrpc 2024-04-23 17:26:25 UTC 
This issue has been addressed in the following products:

  Satellite Client 6 for RHEL 6
  Satellite Client 6 for RHEL 7
  Satellite Client 6 for RHEL 8
  Satellite Client 6 for RHEL 9

Via RHSA-2024:2011 https://access.redhat.com/errata/RHSA-2024:2011
Note You need to log in before you can comment on or make changes to this bug.