When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same han…
Critical CVSS 9.8
Summary
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle whe…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
- :
- :
- :
- :
- :
- :
- :
Sources
- NVD DATABASE
Original Links
- http://seclists.org/fulldisclosure/2023/Jan/19 Mailing List
- http://seclists.org/fulldisclosure/2023/Jan/20 Mailing List
- http://www.openwall.com/lists/oss-security/2023/05/17/4 Mailing List
- https://hackerone.com/reports/1704017 Exploit
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html Mailing List
- https://security.gentoo.org/glsa/202212-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230110-0006/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230208-0002/ Third Party Advisory
- https://support.apple.com/kb/HT213604 Third Party Advisory
- https://support.apple.com/kb/HT213605 Third Party Advisory
- https://www.debian.org/security/2023/dsa-5330 Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jan/19 Mailing List
- http://seclists.org/fulldisclosure/2023/Jan/20 Mailing List
- http://www.openwall.com/lists/oss-security/2023/05/17/4 Mailing List
- https://hackerone.com/reports/1704017 Exploit
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html Mailing List
- https://security.gentoo.org/glsa/202212-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230110-0006/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230208-0002/ Third Party Advisory
- https://support.apple.com/kb/HT213604 Third Party Advisory
- https://support.apple.com/kb/HT213605 Third Party Advisory
- https://www.debian.org/security/2023/dsa-5330 Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-892048.html
Timeline
- nvd_ingest NVD