Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2021-22922 When curl is instructed to download content using the metalink feature, thecontents is verified against a hash…

Description

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

Produits et versions touchés

Produit Versions touchées Corrigé en
https://github.com/curl/curl Versions non publiées
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de https://github.com/curl/curl

Les 51 CVE de https://github.com/curl/curl →
CVE-2023-28322 An information disclosure vulnerability exists in… 5.3 Moyenne CVE-2023-28319 A use after free vulnerability exists in… 7.5 Élevée CVE-2023-28320 A denial of service vulnerability exists in… 5.9 Moyenne CVE-2023-28321 An improper certificate validation vulnerability exists in… 5.9 Moyenne
Suivre cette CVE