The Curl Project curl
At a glance
- Source
- NVD
- EPSS
- EPSS 6.25 % · percentile 94 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.
Weaknesses (CWE)
- CWE-20 — Improper Input Validation
References
- https://access.redhat.com/errata/RHSA-2018:3558
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624
- https://www.tenable.com/security/tns-2016-21
- http://www.securitytracker.com/id/1037192
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://curl.haxx.se/docs/adv_20161102J.html
- https://access.redhat.com/errata/RHSA-2018:2486
- https://security.gentoo.org/glsa/201701-47
- http://www.securityfocus.com/bid/94103
- https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | redhat |
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2016-9469
- GCVE · GCVE-0-2016-8624
CERT-FR advisories
- CERTFR-2019-AVI-325 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2018-AVI-339 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2016-AVI-411 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*< 7.51.0
Affected products
| Product | Versions |
|---|---|
| The Curl Project · curl | affected 7.51.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |