It was found that curl might dereference a near-NULL address when getting an LDAP URL. The function `ldap_get_attribute_ber()` is called to get attributes, but it turns out that it can return `LDAP_SUCCESS` and still return a `NULL` pointer in the result pointer when getting a particularly crafted response. libcurl-using applications that allow LDAP URLs, or that allow redirects to LDAP URLs could be made to crash by a malicious server.
Acknowledgments: Name: the Curl project Upstream: Dario Weisser
Created attachment 1405334 [details] upstream patch
External References: https://curl.haxx.se/docs/adv_2018-97a2.html
Created mingw-curl tracking bugs for this issue: Affects: fedora-all [bug 1555207] Created curl tracking bugs for this issue: Affects: fedora-all [bug 1555209] Created mingw-curl tracking bugs for this issue: Affects: epel-7 [bug 1555208]
Upstream fix: openldap: check ldap_get_attribute_ber() results for NULL before using https://github.com/curl/curl/commit/9889db0433
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:3157 https://access.redhat.com/errata/RHSA-2018:3157
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2018:3558 https://access.redhat.com/errata/RHSA-2018:3558
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.5 Extended Update Support Via RHSA-2020:0544 https://access.redhat.com/errata/RHSA-2020:0544
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions Red Hat Enterprise Linux 7.4 Telco Extended Update Support Via RHSA-2020:0594 https://access.redhat.com/errata/RHSA-2020:0594