Bug 1536013 (CVE-2018-1000005) - CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers
Summary: CVE-2018-1000005 curl: Out-of-bounds read in code handling HTTP/2 trailers
Alias: CVE-2018-1000005
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1536014 1699816 1699817
Blocks: 1696275
TreeView+ depends on / blocked
Reported: 2018-01-18 12:55 UTC by Adam Mariš
Modified: 2021-02-17 00:56 UTC (History)
17 users (show)

Fixed In Version: curl 7.58.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2019-07-12 13:04:58 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1543 0 None None None 2019-06-18 19:09:05 UTC

Description Adam Mariš 2018-01-18 12:55:47 UTC
An out-of-bounds read in code handling HTTP/2 trailers was found. This could lead to a denial-of-service or an information disclosure in some circumstances.

Affected versions: libcurl 7.49.0 to and including 7.57.0
Not affected versions: libcurl < 7.49.0 and >= 7.58.0

Upstream bug report:


Upstream patch:


Comment 1 Adam Mariš 2018-01-18 12:55:51 UTC

Name: the Curl project
Upstream: Zhouyihai Ding

Comment 3 Adam Mariš 2018-01-24 08:11:28 UTC
External References:


Comment 6 Hardik Vyas 2019-04-10 10:50:13 UTC
The latest version of curl shipped by ceph-2 is 7.29.0-32.el7(~3 years back), however which is not affected by this flaw. Ceph-2 no more ships updated version of curl and consumes latest available releases from RHEL repo.

Comment 8 Huzaifa S. Sidhpurwala 2019-04-15 06:39:58 UTC
This bug was essentially introduced by the following commit:

Comment 9 Huzaifa S. Sidhpurwala 2019-04-15 06:40:06 UTC

This flaw was introduced in curl-7.49.0. Therefore the versions of curl shipped with Red Hat Enterprise Linux 5, 6 and 7 and Red Hat Ceph Storage 2 are not affected by this flaw.

Comment 10 Joshua Padman 2019-04-15 10:01:53 UTC
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1699816]

Created mingw-curl tracking bugs for this issue:

Affects: fedora-all [bug 1699817]

Comment 11 errata-xmlrpc 2019-06-18 19:09:04 UTC
This issue has been addressed in the following products:

  JBoss Core Services Apache HTTP Server 2.4.29 SP2

Via RHSA-2019:1543 https://access.redhat.com/errata/RHSA-2019:1543

Comment 12 Product Security DevOps Team 2019-07-12 13:04:58 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.