Bug 2152652 (CVE-2022-43552) - CVE-2022-43552 curl: Use-after-free triggered by an HTTP proxy deny response [NEEDINFO]
Summary: CVE-2022-43552 curl: Use-after-free triggered by an HTTP proxy deny response
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-43552
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2152789 2152790 2155435 2155436 2158513
Blocks: 2152645
TreeView+ depends on / blocked
 
Reported: 2022-12-12 15:48 UTC by Marian Rehak
Modified: 2024-01-24 16:49 UTC (History)
20 users (show)

Fixed In Version: curl 7.87.0
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it supports through an HTTP proxy. HTTP proxies can deny these tunnel operations using an appropriate HTTP error response code. When getting denied to tunnel the specific SMB or TELNET protocols, curl can use a heap-allocated struct after it has been freed and shut down the code path in its transfer.
Clone Of:
Environment:
Last Closed: 2023-06-05 18:17:18 UTC
Embargoed:
mrehak: needinfo? (mdogra)

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:2478 0 None None None 2023-05-09 07:52:10 UTC
Red Hat Product Errata RHSA-2023:2963 0 None None None 2023-05-16 08:35:14 UTC
Red Hat Product Errata RHSA-2023:3354 0 None None None 2023-06-05 11:50:54 UTC
Red Hat Product Errata RHSA-2023:3355 0 None None None 2023-06-05 11:47:04 UTC
Red Hat Product Errata RHSA-2023:7743 0 None None None 2023-12-12 16:17:32 UTC
Red Hat Product Errata RHSA-2024:0428 0 None None None 2024-01-24 16:49:08 UTC

Description Marian Rehak 2022-12-12 15:48:58 UTC 
curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations using an appropriate HTTP error response code. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Reference:

https://curl.se/docs/CVE-2022-43552.html
Comment 2 Sandipan Roy 2022-12-21 09:08:12 UTC 
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 2155435]


Created mingw-curl tracking bugs for this issue:

Affects: fedora-all [bug 2155436]
Comment 4 errata-xmlrpc 2023-05-09 07:52:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2478 https://access.redhat.com/errata/RHSA-2023:2478
Comment 5 errata-xmlrpc 2023-05-16 08:35:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2963 https://access.redhat.com/errata/RHSA-2023:2963
Comment 6 errata-xmlrpc 2023-06-05 11:47:01 UTC 
This issue has been addressed in the following products:

  JBCS httpd 2.4.51.sp2

Via RHSA-2023:3355 https://access.redhat.com/errata/RHSA-2023:3355
Comment 7 errata-xmlrpc 2023-06-05 11:50:51 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2023:3354 https://access.redhat.com/errata/RHSA-2023:3354
Comment 8 Product Security DevOps Team 2023-06-05 18:17:15 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-43552
Comment 18 errata-xmlrpc 2023-12-12 16:17:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:7743 https://access.redhat.com/errata/RHSA-2023:7743
Comment 19 errata-xmlrpc 2024-01-24 16:49:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0428 https://access.redhat.com/errata/RHSA-2024:0428
Note You need to log in before you can comment on or make changes to this bug.