mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
85 lines
3.0 KiB
JSON
85 lines
3.0 KiB
JSON
{
|
|
"CVE_data_meta" : {
|
|
"ASSIGNER" : "cve-assign@distributedweaknessfiling.org",
|
|
"DATE_ASSIGNED" : "2018-01-17",
|
|
"ID" : "CVE-2018-1000005",
|
|
"REQUESTER" : "daniel@haxx.se",
|
|
"STATE" : "PUBLIC"
|
|
},
|
|
"affects" : {
|
|
"vendor" : {
|
|
"vendor_data" : [
|
|
{
|
|
"product" : {
|
|
"product_data" : [
|
|
{
|
|
"product_name" : "libcurl",
|
|
"version" : {
|
|
"version_data" : [
|
|
{
|
|
"version_value" : "libcurl 7.49.0 to and including 7.57.0"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"vendor_name" : "libcurl"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"data_format" : "MITRE",
|
|
"data_type" : "CVE",
|
|
"data_version" : "4.0",
|
|
"description" : {
|
|
"description_data" : [
|
|
{
|
|
"lang" : "eng",
|
|
"value" : "libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something."
|
|
}
|
|
]
|
|
},
|
|
"problemtype" : {
|
|
"problemtype_data" : [
|
|
{
|
|
"description" : [
|
|
{
|
|
"lang" : "eng",
|
|
"value" : "out bounds read"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"references" : {
|
|
"reference_data" : [
|
|
{
|
|
"name" : "https://curl.haxx.se/docs/adv_2018-824a.html",
|
|
"refsource" : "CONFIRM",
|
|
"url" : "https://curl.haxx.se/docs/adv_2018-824a.html"
|
|
},
|
|
{
|
|
"name" : "https://github.com/curl/curl/pull/2231",
|
|
"refsource" : "CONFIRM",
|
|
"url" : "https://github.com/curl/curl/pull/2231"
|
|
},
|
|
{
|
|
"name" : "DSA-4098",
|
|
"refsource" : "DEBIAN",
|
|
"url" : "https://www.debian.org/security/2018/dsa-4098"
|
|
},
|
|
{
|
|
"name" : "USN-3554-1",
|
|
"refsource" : "UBUNTU",
|
|
"url" : "https://usn.ubuntu.com/3554-1/"
|
|
},
|
|
{
|
|
"name" : "1040273",
|
|
"refsource" : "SECTRACK",
|
|
"url" : "http://www.securitytracker.com/id/1040273"
|
|
}
|
|
]
|
|
}
|
|
}
|