Bug 2152652 (CVE-2022-43552) - CVE-2022-43552 curl: Use-after-free triggered by an HTTP proxy deny response
Summary: CVE-2022-43552 curl: Use-after-free triggered by an HTTP proxy deny response
Keywords:
Status: NEW
Alias: CVE-2022-43552
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2155436 Red Hat2152789 Red Hat2152790 2155435 Red Hat2158513
Blocks: Embargoed2152645
TreeView+ depends on / blocked
 
Reported: 2022-12-12 15:48 UTC by Marian Rehak
Modified: 2023-05-16 08:35 UTC (History)
18 users (show)

Fixed In Version: curl 7.87.0
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it supports through an HTTP proxy. HTTP proxies can deny these tunnel operations using an appropriate HTTP error response code. When getting denied to tunnel the specific SMB or TELNET protocols, curl can use a heap-allocated struct after it has been freed and shut down the code path in its transfer.
Clone Of:
Environment:
Last Closed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:2478 0 None None None 2023-05-09 07:52:10 UTC
Red Hat Product Errata RHSA-2023:2963 0 None None None 2023-05-16 08:35:14 UTC

Description Marian Rehak 2022-12-12 15:48:58 UTC 
curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations using an appropriate HTTP error response code. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Reference:

https://curl.se/docs/CVE-2022-43552.html
Comment 2 Sandipan Roy 2022-12-21 09:08:12 UTC 
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 2155435]


Created mingw-curl tracking bugs for this issue:

Affects: fedora-all [bug 2155436]
Comment 4 errata-xmlrpc 2023-05-09 07:52:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2478 https://access.redhat.com/errata/RHSA-2023:2478
Comment 5 errata-xmlrpc 2023-05-16 08:35:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2963 https://access.redhat.com/errata/RHSA-2023:2963
Note You need to log in before you can comment on or make changes to this bug.