CVE-2018-1000005

Description

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like : to the target buffer, while this was recently changed to : (a space was added after the colon) but the following math wasnt updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something.

Risk Information

Base Score

9.1

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS Score

Exploitation Probability

0.472

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2018-1000005 are affected in Curl For Windows 7.57.0	Windows
Vulnerabilities CVE-2018-1000007,CVE-2018-1000005 are fixed in Curl For Windows 7.58.0	Windows
curl security update(DSA-4098-1) curl_7.38.0-4+deb8u9_i386.deb	Linux
curl security update(DSA-4098-1) curl_7.38.0-4+deb8u9_amd64.deb	Linux
curl security update(DSA-4098-1) curl_7.52.1-5+deb9u4_i386.deb	Linux
curl security update(DSA-4098-1) curl_7.52.1-5+deb9u4_amd64.deb	Linux
Out-of-bounds Read Vulnerability (CVE-2018-1000005)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234