REDHAT-BUG-2446448: Medium severity libcurl vulnerability
libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request.
libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates connections and not requests, contrary to how HTTP is designed to work.
An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with user1:password1 and then does another operation to the same server also using Negotiate but with user2:password2 (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1...
The set of authentication methods to use is set with CURLOPTHTTPAUTH.
Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: CURLOPTFRESHCONNECT, CURLOPTMAXCONNECTS and CURLMOPTMAXHOSTCONNECTIONS (if using the curlmulti API).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable libcurl connection reuse (set CURLOPT_FRESH_CONNECT so that requests do not reuse an existing connection when using Negotiate authentication).
libcurl CURLOPT_FRESH_CONNECT = true - Configuration
Limit the number of concurrent connections per host by setting CURLOPT_MAXCONNECTS (to prevent reuse of a connection that has been Negotiate-authenticated with different credentials).
libcurl CURLOPT_MAXCONNECTS = 1 - Configuration
If using the curl_multi API, limit per-host connections by setting CURLMOPT_MAX_HOST_CONNECTIONS to a low value (to prevent reuse of an existing Negotiate-authenticated connection across different credentials).
libcurl CURLMOPT_MAX_HOST_CONNECTIONS = 0 or 1
Event History
Frequently Asked Questions
Which applications are exposed to this connection reuse issue?
Applications are exposed when they allow Negotiate authentication to the same HTTP or HTTPS server using different credential sets while an earlier authenticated connection remains alive in libcurl’s connection pool.
What happens when the issue is triggered?
A later request intended to use a second set of credentials can be sent over an existing connection authenticated as the first user. The application may believe the request uses the second user’s credentials, but the server treats it as authenticated with the credentials associated with the reused connection.