Aller au contenu
en Se connecter
Non notée

CVE-2021-22901 curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when…

Description

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.

Produits et versions touchés

Produit Versions touchées Corrigé en
https://github.com/curl/curl Versions non publiées
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de https://github.com/curl/curl

Les 51 CVE de https://github.com/curl/curl →
CVE-2023-28322 An information disclosure vulnerability exists in… 5.3 Moyenne CVE-2023-28319 A use after free vulnerability exists in… 7.5 Élevée CVE-2023-28320 A denial of service vulnerability exists in… 5.9 Moyenne CVE-2023-28321 An improper certificate validation vulnerability exists in… 5.9 Moyenne
Suivre cette CVE