REDHAT-BUG-2301888: Low severity curl libcurl vulnerability
libcurl's ASN1 parser code has the GTime2str() function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a strlen() getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.
This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when CURLINFOCERTINFO (https://curl.se/libcurl/c/CURLINFOCERTINFO.html) is used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Avoid calling curl_easy_getinfo(..., CURLINFO_CERTINFO, ...) or otherwise requesting certificate information from libcurl until an official fix is available. Using CURLINFO_CERTINFO can trigger parsing of malformed ASN.1 Generalized Time fields and may cause crashes or return heap contents to the application.
libcurl / application using libcurl CURLINFO_CERTINFO = do not use / disabled - Compensating control
Do not request certificate details from untrusted peers. Restrict network access to only trusted servers or place certificate-inspecting traffic behind a hardened proxy/validation service that validates certificates before exposing them to libcurl, to reduce exposure to crafted ASN.1 fields.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2301888?
The severity of REDHAT-BUG-2301888 is classified as high due to potential memory corruption risks.
How do I fix REDHAT-BUG-2301888?
To fix REDHAT-BUG-2301888, update to the latest patched version of libcurl provided by your distribution.
Which versions of libcurl are affected by REDHAT-BUG-2301888?
libcurl with GnuTLS support is affected by REDHAT-BUG-2301888, particularly version 3.
What are the potential impacts of REDHAT-BUG-2301888?
The potential impacts of REDHAT-BUG-2301888 include application crashes or exploitation leading to denial of service.
Is there a workaround for REDHAT-BUG-2301888?
There are currently no viable workarounds for REDHAT-BUG-2301888 aside from updating to a patched version.