En

curl官网安全更新(2021-07-21)

来源:curl官网 发布日期:2021-07-21 阅读次数:6123 评论:0

基本信息

发布日期:2021-07-21(官方当地时间)

更新类型:安全更新

更新版本:未知

感知时间:2021-07-21 15:06:19

风险等级:中危

情报贡献:TSRC

更新标题

Bad connection reuse due to flawed path name checks

更新详情

curl / Docs / Security Problems / Bad connection reuse due to flawed path name checksRelated:
Bug Bounty
Changelog
Donate
FAQ
Security Problems
Security Process
Vulnerabilities TableBad connection reuse due to flawed path name checks
Project curl Security Advisory, July 21st 2021 - Permalink
VULNERABILITY
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup.
Due to errors in the logic, the config matching function did not take 'issuer cert' into account and it compared the involved paths case insensitively, which could lead to libcurl reusing wrong connections.
File paths are, or can be, case sensitive on many systems but not all, and can even vary depending on used file systems.
The comparison also didn't include the 'issuer cert' which a transfer can set to qualify how to verify the server certificate.
We are not aware of any exploit of this flaw.
INFO
This flaw has existed in curl since commit 89721ff04af70f in libcurl 7.10.4, released on April 2, 2003.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2021-22924 to this issue.
CWE-295: Improper Certificate Validation
Severity: Medium
AFFECTED VERSIONSAffected versions: curl 7.10.4 to and including 7.77.0
Not affected versions: curl < 7.10.4 and curl >= 7.78.0Also note that libcurl is used by many applications, and not always advertised as such.
THE SOLUTION
The SSL configs are compared appropriately.
A fix for CVE-2021-22924
RECOMMENDATIONS
A - Upgrade curl to version 7.78.0
B - Apply the patch to your local version
TIMELINE
This issue was reported to the curl project on June 11, 2021.
This advisory was posted on July 21, 2021.
CREDITS
This issue was reported by Harry Sintonen. Patched by Daniel Stenberg.
Thanks a lot!

软件描述

cURL是一个利用URL语法在命令行下工作的文件传输工具,1997年首次发行。它支持文件上传和下载,所以是综合传输工具,但按传统,习惯称cURL为下载工具

CVE编号

TSRC分析

暂无

业界资讯

暂无

评论

提交评论 您输入的评论有误,请重新输入