Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 2241933 (CVE-2023-38545)
| Summary: | CVE-2023-38545 curl: heap based buffer overflow in the SOCKS5 proxy handshake | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | bbuckingham, bcourt, csutherl, ehelms, gcovolo, jclere, jmigacz, jsherril, kyoshida, lzap, mdogra, mharbi, mhulan, mturk, nmoumoul, orabin, pajung, pcreech, peholase, pjindal, plodge, ravpatil, rchan, romain.geissler, sbalasub, security-response-team, szappis, tdamato, ytale |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | Flags: | ytale:
needinfo-
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | curl 8.4.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A heap-based buffer overflow flaw was found in the SOCKS5 proxy handshake in the Curl package. If Curl is unable to resolve the address itself, it passes the hostname to the SOCKS5 proxy. However, the maximum length of the hostname that can be passed is 255 bytes. If the hostname is longer, then Curl switches to the local name resolving and passes the resolved address only to the proxy. The local variable that instructs Curl to "let the host resolve the name" could obtain the wrong value during a slow SOCKS5 handshake, resulting in the too-long hostname being copied to the target buffer instead of the resolved address, which was not the intended behavior.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2245215, 2245216, 2243182, 2245214, 2245217, 2249884 | ||
| Bug Blocks: | |||
|
Description
Marian Rehak
2023-10-03 13:54:40 UTC
Created curl tracking bugs for this issue: Affects: fedora-all [bug 2243182] This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:5700 https://access.redhat.com/errata/RHSA-2023:5700 FEDORA-2023-b855de5c0f has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report. This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:5763 https://access.redhat.com/errata/RHSA-2023:5763 FEDORA-2023-fef2b8da32 has been pushed to the Fedora 37 stable repository. If problem still persists, please make note of it in this bug report. This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:6745 https://access.redhat.com/errata/RHSA-2023:6745 This issue has been addressed in the following products: JBoss Core Services on RHEL 7 JBoss Core Services for RHEL 8 Via RHSA-2023:7625 https://access.redhat.com/errata/RHSA-2023:7625 This issue has been addressed in the following products: Red Hat JBoss Core Services Via RHSA-2023:7626 https://access.redhat.com/errata/RHSA-2023:7626 This issue has been addressed in the following products: Red Hat Satellite 6.14 for RHEL 8 Via RHSA-2024:0797 https://access.redhat.com/errata/RHSA-2024:0797 This issue has been addressed in the following products: Satellite Client 6 for RHEL 6 Satellite Client 6 for RHEL 7 Satellite Client 6 for RHEL 8 Satellite Client 6 for RHEL 9 Via RHSA-2024:2011 https://access.redhat.com/errata/RHSA-2024:2011 |