Описание
When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer. This is due to an out of bounds read
following when gnutls_record_send() returns a number of bytes sent greater
than the number of bytes it was given to send. GnuTLS does that after a
blocked send.
A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS).
Отчет
This vulnerability is rated as Low impact because exploitation is constrained to curl builds utilizing the GnuTLS backend connecting to an untrusted WebSocket server, with consequences limited to an application crash or minor memory exposure. Standard curl deployments in Red Hat products typically use alternative TLS libraries such as OpenSSL, significantly reducing exposure. Furthermore, triggering this behavior requires a specific I/O blocking condition during WebSocket communication, making successful exploitation difficult to achieve in practice.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | curl | Not affected | ||
| Red Hat Enterprise Linux 10 | igvm | Not affected | ||
| Red Hat Enterprise Linux 10 | rust | Not affected | ||
| Red Hat Enterprise Linux 10 | s390utils | Not affected | ||
| Red Hat Enterprise Linux 10 | snphost | Not affected | ||
| Red Hat Enterprise Linux 10 | trustee | Not affected | ||
| Red Hat Enterprise Linux 6 | curl | Not affected | ||
| Red Hat Enterprise Linux 7 | curl | Not affected | ||
| Red Hat Enterprise Linux 8 | curl | Not affected | ||
| Red Hat Enterprise Linux 9 | curl | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.8 Medium
CVSS3
Связанные уязвимости
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.
When curl is built with GnuTLS, a malicious WebSocket server can make ...
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.
EPSS
4.8 Medium
CVSS3