curl vulnerabilities

When curl is asked to use a `.netrc` file for credentials and to follow HTTP redirects, it could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests if the netrc file has an entry matching the redirect target hostname.

When curl is told to use the Certificate Status Request TLS extension (OCSP stapling) to verify the server certificate, it might fail to detect some OCSP problems and wrongly consider the response as fine if the returned status reports another error than expected.

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects applications using HSTS and URLs with the insecure HTTP:// scheme.

When curl uses a .netrc file for credentials and a URL with a username (without password) is specified, curl may wrongly retrieve and use the password of another user from .netrc for that host if no match exists for the specified user.

A double-free vulnerability has been found in the curl library's SASL authentication handling. The GSASL context is cleaned up twice without clearing the pointer, causing free() to be called on the same memory region twice.

A flaw in curl's cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check, enabling injection of cookies that curl scopes and sends to unrelated third-party domains.

CVE-2023-38545 is a vulnerability related to heap buffer overflow during the SOCKS5 proxy handshake in curl. The issue arises when curl passes a hostname that is too long to the proxy, leading to incorrect data copying.

curl versions 7.75.0 through 7.76.1 suffer from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client.

A Set-Cookie header using a tab (ASCII 9) instead of a space (ASCII 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

A vulnerability in curl causes the tool layer to skip initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS when using a schemeless URL with `--proto-default sftp` (or scp), while libcurl establishes the SFTP/SCP connection. This results in curl connecting to an unverified SSH remote host without error.

Curl lacks an upper bound on memory allocation for unacknowledged WebSocket PING frames, allowing a malicious server to exhaust all available memory by sending rapid sequential PING messages.

A vulnerability in curl's QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service (DoS) against a curl or libcurl client. The helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, enabling a connected QUIC peer to continuously stream empty datagrams and indefinitely stall the client.

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when: 1. curl is set up to use different proxies for different URL schemes, 2. the first proxy needs credentials, 3. the second proxy uses no credentials, 4. while using the first proxy (e.g., http://), curl is asked to follow a redirect to a URL using another scheme (e.g., https://), accessed via a second, different proxy.

When an OAuth2 bearer token is used for an HTTP(S) transfer and that transfer redirects to a second URL, curl may leak the token to the second hostname under some circumstances. If the redirect target hostname has an entry in the .netrc file with the machine or default keyword, curl passes the bearer token set for the first host to the second one.

During SSH-based transfers using SCP or SFTP, when public key authentication is requested, curl incorrectly asks and authenticates using a locally running SSH agent.

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

When using the CURLOPT_PINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool, curl should check the public key of the server certificate. This check was skipped under a certain condition, allowing the connection without proper verification and failing to notice a possible impostor. The condition required a QUIC connection with ngtcp2 built with GnuTLS and explicit disabling of standard certificate verification.

A bug in curl's cookie path comparison logic makes curl read outside a heap buffer boundary. The scenario involves a cookie set with the secure keyword for https://target, a redirect to http://target (same hostname, clear text HTTP), and the same cookie name set with only a slash as path ("/"). The bug either causes a crash or makes the comparison come to the wrong conclusion, letting the clear-text site override the contents of the secure cookie.

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification requires. Instead it used a fixed mask that persisted throughout the entire connection. A predictable mask pattern allows a malicious server to induce traffic that an involved proxy may interpret as genuine HTTP traffic and poison its cache.

In curl 7.65.2, an integer overflow occurs in tool_operate.c with a large retry delay value.

curl's HSTS support can be bypassed when the host name in the URL uses a trailing dot while the HSTS cache entry does not (or vice versa). This allows the insecure clear-text HTTP step to occur despite HSTS being enabled.

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

An information disclosure vulnerability exists in curl versions 7.65.0 to 7.82.0 that allows reusing a connection using an IPv6 address with a different zone id.

An improper authentication vulnerability exists in curl versions 7.33.0 to 7.82.0 which might allow reuse of OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S), and LDAP(S) (openldap only).