Bug 2301888 (CVE-2024-7264) - CVE-2024-7264 curl: libcurl: ASN.1 date parser overread
Summary: CVE-2024-7264 curl: libcurl: ASN.1 date parser overread
Keywords:
Status: NEW
Alias: CVE-2024-7264
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2309414 2309415 2319437
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-31 04:36 UTC by Patrick Del Bello
Modified: 2026-01-28 09:24 UTC (History)
44 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2025:1988 0 None None None 2025-03-03 07:39:28 UTC
Red Hat Product Errata RHSA-2024:7726 0 None None None 2024-10-07 09:24:55 UTC
Red Hat Product Errata RHSA-2025:1671 0 None None None 2025-02-19 10:27:04 UTC
Red Hat Product Errata RHSA-2025:1673 0 None None None 2025-02-19 11:04:26 UTC

Description Patrick Del Bello 2024-07-31 04:36:11 UTC 
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.

This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when
CURLINFO_CERTINFO (https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
Comment 1 errata-xmlrpc 2024-10-07 09:24:51 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Service Mesh 2.6 for RHEL 8
  Red Hat OpenShift Service Mesh 2.6 for RHEL 9

Via RHSA-2024:7726 https://access.redhat.com/errata/RHSA-2024:7726
Comment 4 errata-xmlrpc 2025-02-19 10:27:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:1671 https://access.redhat.com/errata/RHSA-2025:1671
Comment 5 errata-xmlrpc 2025-02-19 11:04:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:1673 https://access.redhat.com/errata/RHSA-2025:1673
Comment 7 antal.nemes 2025-03-27 14:01:25 UTC 
For RedHat Enterprise Linux 8, RHSA-2025:1673 shows only mysql-related packages as updated, but CVE-2024-7264 is a vulnerability in libcurl, so I would expect libcurl and curl to be among the updated packages in this RHSA.

I checked the latest sources in RHEL8 and I do not see libcurl being updated with the upstream patch. Will there be an update for libcurl published for CVE-2024-7264 that includes this fix?
Comment 13 antal.nemes 2026-01-28 09:24:56 UTC 
https://access.redhat.com/security/cve/cve-2024-7264 states:

> Red Hat build of curl uses OpenSSL, which is not included in the affected list of GnuTLS, Schannel, Secure Transport and mbedTLS. Inspect which TLS backend is in use by running:

Can this CVE be marked as "not affected" for RedHat Enterprise Linux 8 and 9.
Note You need to log in before you can comment on or make changes to this bug.