CVE-2020-19909: Integer Overflow
First published: Tue Aug 22 2023(Updated: )
** DISPUTED ** Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Haxx Curl | =7.65.2 | |
| =7.65.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-everything-that-is-wrong-with-cves/
- https://github.com/curl/curl/pull/4166
- https://www.bleepingcomputer.com/news/security/dev-makes-his-github-repo-read-only-after-dubious-cve-report/
- https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/
Frequently Asked Questions
What is CVE-2020-19909?
CVE-2020-19909 refers to an integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay.
What is the severity of CVE-2020-19909?
CVE-2020-19909 has a severity value of 3.3, which is considered low.
How does CVE-2020-19909 impact the curl user?
Many parties report that CVE-2020-19909 has no direct security impact on the curl user.
Can CVE-2020-19909 cause a denial of service to associated systems or networks?
In theory, CVE-2020-19909 may cause a denial of service to associated systems or networks.
How can I fix CVE-2020-19909?
To fix CVE-2020-19909, update to a version of curl that does not have the vulnerability.
- collector/nvd-index
- agent/author
- agent/type
- agent/severity
- agent/weakness
- agent/remedy
- agent/status
- agent/softwarecombine
- agent/description
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2023-42282
- alias/CVE-2020-19909
- alias/CVE-2024-4067
- agent/references
- agent/first-publish-date
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- status/disputed
- vendor/haxx
- canonical/haxx curl
- version/haxx curl/7.65.2