Buy commercial curl support from WolfSSL. We help you work
out your issues, debug your libcurl applications, use the API, port to new
platforms, add new features and more. With a team lead by the curl founder
himself.
[SECURITY ADVISORY] curl: HSTS long file name clears contents
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-users <curl-users_at_lists.haxx.se>
Date: Wed, 6 Dec 2023 08:29:50 +0100 (CET)
HSTS long file name clears contents
===================================
Project curl Security Advisory, December 6 2023 -
[Permalink](https://curl.se/docs/CVE-2023-46219.html)
VULNERABILITY
-------------
When saving HSTS data to an excessively long file name, curl could end up
removing all contents, making subsequent requests using that file unaware of
the HSTS status they should otherwise use.
INFO
Date: Wed, 6 Dec 2023 08:29:50 +0100 (CET)
HSTS long file name clears contents
===================================
Project curl Security Advisory, December 6 2023 -
[Permalink](https://curl.se/docs/CVE-2023-46219.html)
VULNERABILITY
-------------
When saving HSTS data to an excessively long file name, curl could end up
removing all contents, making subsequent requests using that file unaware of
the HSTS status they should otherwise use.
INFO
---- The reason for this bug is that save function appended a suffix to the file name, created a temporary file and then in the last step renamed that to the final name. When the file name length was close to the limit of what is allowed on the file system, adding the extension would make it too long and then trigger this bug. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2023-46219 to this issue. CWE-311: Missing Encryption of Sensitive Data Severity: Low AFFECTED VERSIONS ----------------- - Affected versions: curl 7.84.0 to and including 8.4.0 - Not affected versions: curl < 7.84.0 and >= 8.5.0 - Introduced-in: https://github.com/curl/curl/commit/20f9dd6bae50b722 libcurl is used by many applications, but not always advertised as such! This flaw is also accessible using the curl command line tool. SOLUTION ------------ Starting in curl 8.5.0, the temporary file name made done using a pure random sequence of letters instead of being based on the original. - Fixed-in: https://github.com/curl/curl/commit/73b65e94f3531179de45 RECOMMENDATIONS -------------- A - Upgrade curl to version 8.5.0 B - Apply the patch to your local version C - Do not use HSTS TIMELINE -------- This issue was reported to the curl project on November 2, 2023. We contacted distros_at_openwall on November 28, 2023. curl 8.5.0 was released on December 6 2023, coordinated with the publication of this advisory. CREDITS ------- - Reported-by: Maksymilian Arciemowicz - Patched-by: Daniel Stenberg Thanks a lot! -- / daniel.haxx.se -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2023-12-06