CVE-2018-1000005
Description
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
Arch Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Fixed | 7.58.0-1 |
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 7.58.0-1 |
| sid | Fixed | 7.58.0-1 |
| forky | Fixed | 7.58.0-1 |
| bullseye | Fixed | 7.58.0-1 |
| bookworm | Fixed | 7.58.0-1 |
References
- https://security.archlinux.org/ASA-201801-26
- https://security.archlinux.org/ASA-201801-25
- https://security.archlinux.org/ASA-201801-24
- https://security.archlinux.org/ASA-201801-23
- https://security.archlinux.org/ASA-201801-22
- https://security.archlinux.org/ASA-201801-20
- https://security-tracker.debian.org/tracker/CVE-2018-1000005
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.