Описание
Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
A use-after-free flaw was found in libcurl. When invoking curl_easy_perform() after cleaning up a multi session, an application can be tricked into using libcurl to connect to a malicious server, allowing an attacker to potentially execute arbitrary code. The highest threat from this vulnerability is to data confidentiality and integrity as well as data confidentiality.
Отчет
The versions of curl as shipped with Red Hat Enterprise Linux 5, 6, and 7 are marked as "notaffected" because they did not include the vulnerable code, which was introduced in a later version of the package. Specifically, the struct field affected by this flaw was introduced in curl upstream version 7.32.0. The version of curl as shipped with Red Hat Enterprise Linux 7 is 7.29.0.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| .NET Core 1.0 on Red Hat Enterprise Linux | rh-dotnetcore10-curl | Out of support scope | ||
| .NET Core 1.1 on Red Hat Enterprise Linux | rh-dotnetcore11-curl | Out of support scope | ||
| .NET Core 2.0 on Red Hat Enterprise Linux | rh-dotnet20-curl | Out of support scope | ||
| .NET Core 2.1 on Red Hat Enterprise Linux | rh-dotnet21-curl | Will not fix | ||
| Red Hat Enterprise Linux 5 | curl | Not affected | ||
| Red Hat Enterprise Linux 6 | curl | Not affected | ||
| Red Hat Enterprise Linux 7 | curl | Not affected | ||
| Red Hat Enterprise Virtualization 3 | mingw-virt-viewer | Will not fix | ||
| Red Hat JBoss Enterprise Web Server 3 | curl | Not affected | ||
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | httpd24-curl | Fixed | RHSA-2018:3558 | 13.11.2018 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
6.2 Medium
CVSS2
Связанные уязвимости
Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
Use-after-free vulnerability in libcurl before 7.50.1 allows attackers ...
Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
EPSS
8.1 High
CVSS3
6.2 Medium
CVSS2