Уязвимость двойного освобождения памяти в curl при использовании HTTP-прокси для передачи данных через не-HTTP(S) URL
Описание
В curl существует уязвимость двойного освобождения памяти. Если curl настроен использовать HTTP-прокси для передачи данных с не-HTTP(S) URL, он устанавливает соединение с удаленным сервером через отправку запроса CONNECT прокси-серверу, а затем передает остальную часть протокола через туннель. Однако HTTP-прокси может отказаться от выполнения этого запроса (часто прокси разрешают исходящие соединения только на определенные порты, например, 443 для HTTPS) и вернуть клиенту статус-код, отличный от 200. Из-за недостатков в обработке ошибок/очистке памяти, это может привести к ситуации двойного освобождения памяти в curl, если в URL-передачи использовались следующие схемы: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps или telnet.
Затронутые версии ПО
- Начальная затронутая версия: 7.77.0
- Уязвимость устранена в версии: 7.86.0
Тип уязвимости
Двойное освобождение памяти (double free)
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Vendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Vendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одновременно
Одновременно
Одновременно
Одновременно
Одно из
Одно из
EPSS
8.1 High
CVSS3
Дефекты
Связанные уязвимости
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
curl before 7.86.0 has a double free. If curl is told to use an HTTP p ...
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
EPSS
8.1 High
CVSS3