CVE-2018-1000121: Null Pointer Dereference
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service
Other sources
It was found that curl might dereference a near-NULL address when getting an LDAP URL.
The function ldapgetattributeber() is called to get attributes, but it turns out that it can return LDAPSUCCESS and still return a NULL pointer in the result pointer when getting a particularly crafted response.
libcurl-using applications that allow LDAP URLs, or that allow redirects to LDAP URLs could be made to crash by a malicious server.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.59.0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13Fixed in 7.74.0-1.3+deb11u16Fixed in 7.88.1-10+deb12u14Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u3Fixed in 8.20.0-5Fixed in 8.21.0~rc2-1 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u16 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u14 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u5 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.14.1-2+deb13u3 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.20.0-5 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.21.0~rc2-1 - Configuration
If you cannot immediately upgrade, disable acceptance of LDAP URLs in applications that use libcurl and ensure applications do not follow redirects to ldap:// URLs to avoid triggering the LDAP NULL-pointer dereference.
libcurl / curl LDAP URL handling and following redirects to LDAP URLs = disabled
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-1000121.
What is the severity of CVE-2018-1000121?
The severity of CVE-2018-1000121 is high with a severity value of 7.5.
What is the affected software?
The affected software includes curl versions 7.21.0 to 7.58.0.
How can an attacker exploit CVE-2018-1000121?
An attacker can exploit CVE-2018-1000121 to cause a denial of service by triggering a NULL pointer dereference in the LDAP code of curl.
How can CVE-2018-1000121 be fixed?
CVE-2018-1000121 can be fixed by upgrading to curl version 7.59.0 or higher.