Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
[SECURITY ADVISORY] curl: CVE-2024-7264 ASN.1 date parser overread
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Wed, 31 Jul 2024 09:19:47 +0200 (CEST)
ASN.1 date parser overread
==========================
Project curl Security Advisory, July 31st 2024 -
[Permalink](https://curl.se/docs/CVE-2024-7264.html)
VULNERABILITY
-------------
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an
ASN.1 Generalized Time field. If given an syntactically incorrect field, the
parser might end up using -1 for the length of the *time fraction*, leading to
a `strlen()` getting performed on a pointer to a heap buffer area that is not
(purposely) null terminated.
This flaw most likely leads to a crash, but can also lead to heap contents
getting returned to the application when
[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
INFO
Date: Wed, 31 Jul 2024 09:19:47 +0200 (CEST)
ASN.1 date parser overread
==========================
Project curl Security Advisory, July 31st 2024 -
[Permalink](https://curl.se/docs/CVE-2024-7264.html)
VULNERABILITY
-------------
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an
ASN.1 Generalized Time field. If given an syntactically incorrect field, the
parser might end up using -1 for the length of the *time fraction*, leading to
a `strlen()` getting performed on a pointer to a heap buffer area that is not
(purposely) null terminated.
This flaw most likely leads to a crash, but can also lead to heap contents
getting returned to the application when
[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
INFO
---- The ANS.1 parsing is done *after* a successful TLS handshake, which then also means that the used TLS library has parsed the certificate. If the TLS library rejects the bad date string, then it cannot reach and trigger libcurl's bug. We can however not be sure that there are not circumstances in which the bad data still gets parsed by libcurl. This bug is considered a *C mistake* (likely to have been avoided had we not been using C). This flaw also affects the curl command line tool. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2024-7264 to this issue. CWE-125: Out-of-bounds Read Severity: Low AFFECTED VERSIONS ----------------- The vulnerable code can only be reached when curl is built to use GnuTLS, Schannel, Secure Transport or mbedTLS. Builds using other TLS backends are not vulnerable. - Affected versions: curl 7.32.0 to and including 8.9.0 - Not affected versions: curl < 7.32.0 and >= 8.9.1 - Introduced-in: https://github.com/curl/curl/commit/3a24cb7bc45 libcurl is used by many applications, but not always advertised as such! This parser bug was actually introduced in curl 7.32.0 but was then used only by the GSKit TLS backend which is no longer supported. The functionality was later brought to other TLS backends in different versions, so this bug affects curl built with different backends starting in different versions: - GnuTLS since 7.42.0 - Schannel since 7.50.0 - Secure Transport since 7.79.0 - mbedTLS since 8.9.0 SOLUTION ------------ - Fixed-in: https://github.com/curl/curl/commit/27959ecce75cdb2 Note that this fixing commit was a follow-up to this previous incomplete fix: https://github.com/curl/curl/commit/3c914bc680155b321 RECOMMENDATIONS --------------- We suggest you take one of the following actions immediately, in order of preference: A - Upgrade curl and libcurl to version 8.9.1 B - Apply the patch to your version and rebuild C - Build your libcurl with an unaffected TLS backend TIMELINE --------- This issue was reported to the curl project on July 30, 2024. We contacted distros_at_openwall on July 30, 2024. curl 8.9.1 was released on July 31 2024 around 06:00 UTC, coordinated with the publication of this advisory. CREDITS ------- - Reported-by: Dov Murik (Transmit Security) - Patched-by: Daniel Stenberg - Patched-by: Stefan Eissing Thanks a lot! -- / daniel.haxx.se | Commercial curl support up to 24x7 is available! | Private help, bug fixes, support, ports, new features | https://curl.se/support.html -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2024-07-31