Buy commercial curl support from WolfSSL. We help you work
out your issues, debug your libcurl applications, use the API, port to new
platforms, add new features and more. With a team lead by the curl founder
himself.
[SECURITY ADVISORY] CVE-2022-35260: .netrc parser out-of-bounds access (curl)
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Wed, 26 Oct 2022 08:26:39 +0200 (CEST)
CVE-2022-35260: .netrc parser out-of-bounds access
==================================================
Project curl Security Advisory, October 26 2022 -
[Permalink](https://curl.se/docs/CVE-2022-35260.html)
VULNERABILITY
-------------
curl can be told to parse a `.netrc` file for credentials. If that file ends
in a line with consecutive non-white space letters and no newline, curl could
read past the end of the stack-based buffer, and if the read works, write a
zero byte possibly beyond its boundary.
This will in most cases cause a segfault or similar, but circumstances might
also cause different outcomes.
If a malicious user can provide a custom netrc file to an application or
otherwise affect its contents, this flaw could be used as denial-of-service.
We are not aware of any exploit of this flaw.
INFO
Date: Wed, 26 Oct 2022 08:26:39 +0200 (CEST)
CVE-2022-35260: .netrc parser out-of-bounds access
==================================================
Project curl Security Advisory, October 26 2022 -
[Permalink](https://curl.se/docs/CVE-2022-35260.html)
VULNERABILITY
-------------
curl can be told to parse a `.netrc` file for credentials. If that file ends
in a line with consecutive non-white space letters and no newline, curl could
read past the end of the stack-based buffer, and if the read works, write a
zero byte possibly beyond its boundary.
This will in most cases cause a segfault or similar, but circumstances might
also cause different outcomes.
If a malicious user can provide a custom netrc file to an application or
otherwise affect its contents, this flaw could be used as denial-of-service.
We are not aware of any exploit of this flaw.
INFO
---- The flaw was introduced in curl with [this commit](https://github.com/curl/curl/commit/eeaae10c0fb27aa06), first shipped in curl 7.84.0. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2022-35260 to this issue. CWE-121: Stack-based Buffer Overflow Severity: low AFFECTED VERSIONS ----------------- - Affected versions: curl 7.84.0 to and including 7.85.0 - Not affected versions: curl < 7.84.0 and >= 7.86.0 libcurl is used by many applications, but not always advertised as such! THE SOLUTION ------------ [The fix for CVE-2022-35260](https://github.com/curl/curl/commit/c97ec984fb2bc919a3aa86) RECOMMENDATIONS --------------- A - Upgrade curl to version 7.86.0 B - Apply the patch to your local version C - Do not use `.netrc` files TIMELINE -------- This issue was reported to the curl project on October 3, 2022. We contacted distros_at_openwall on October 18, 2022. libcurl 7.86.0 was released on October 26 2022, coordinated with the publication of this advisory. CREDITS ------- - Reported-by: Hiroki Kurosawa - Patched-by: Daniel Stenberg Thanks a lot! -- / daniel.haxx.se | Commercial curl support up to 24x7 is available! | Private help, bug fixes, support, ports, new features | https://curl.se/support.html -- Unsubscribe: https://lists.haxx.se/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2022-10-26