Docs Overview
Project
Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / curl CVEs / HTTP/2 trailer out-of-bounds read
Related:
Audits
Bug Bounty
Changelog
curl CVEs
JSON metadata
Vulnerability Disclosure
Vulnerabilities Table

CVE-2018-1000005

HTTP/2 trailer out-of-bounds read

Project curl Security Advisory, January 24th 2018 - Permalink

VULNERABILITY

libcurl contains an out bounds read in code handling HTTP/2 trailers.

It was reported that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required.

The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like ":" to the target buffer, while this was recently changed to ": " (a space was added after the colon) but the associated math was not updated correspondingly.

When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to the libcurl callback. This might lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something.

INFO

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2018-1000005 to this issue.

CWE-126: Buffer Over-read

Severity: Low

AFFECTED VERSIONS

libcurl is used by many applications, but not always advertised as such.

SOLUTION

In libcurl version 7.58.0, the allocation size is corrected.

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl to version 7.58.0

B - Apply the patch to your version and rebuild

TIMELINE

It was publicly reported to the curl project on January 10, 2018.

The security impact was realized and assessed on January 11. The fix was merged publicly in git on the same day, not mentioning the security impact.

We contacted distros@openwall on January 17.

curl 7.58.0 was released on January 24 2018, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!