CVE-2018-1000301: Critical severity Debian Debian Linux vulnerability
curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content.
When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part.
The function that splits up the response into headers is called Curlhttpreadwriteheaders() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use.
This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw.
Introduced by following patches:
https://github.com/curl/curl/commit/b2ef79ef3d47b37 https://github.com/curl/curl/commit/bc4582b68a673d3
Affected versions: curl 7.20.0 to and including curl 7.59.0 Not affected versions: curl < 7.20.0 and curl >= 7.60.0
Other sources
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.60.0-1 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.60.0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13Fixed in 7.74.0-1.3+deb11u16Fixed in 7.88.1-10+deb12u14Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u3Fixed in 8.20.0-5Fixed in 8.21.0~rc2-1 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u16 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u14 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u5 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.14.1-2+deb13u3 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.20.0-5 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.21.0~rc2-1
Event History
Frequently Asked Questions
What is CVE-2018-1000301?
CVE-2018-1000301 is a vulnerability in curl version curl 7.20.0 to and including curl 7.59.0 that allows a buffer over-read leading to denial of service.
How severe is CVE-2018-1000301?
CVE-2018-1000301 has a severity rating of 9.1, which is classified as critical.
What is the recommended remedy for CVE-2018-1000301?
The recommended remedy for CVE-2018-1000301 is to update curl to version 7.60.0 or higher.
What software versions are affected by CVE-2018-1000301?
CWE-126: Buffer Over-read vulnerability affects curl versions 7.20.0 to 7.59.0.
Where can I find more information about CVE-2018-1000301?
You can find more information about CVE-2018-1000301 in the references: [link1] [link2] [link3].