2

To this day two vulnerabilities are known in curl 7.57.0. Both are related to HTTP:

  • HTTP authentication leak in redirects
  • HTTP/2 trailer out-of-bounds read

My application uses this version of curl and communicates with a single hardcoded web server. The server has a well-known domain name and is controlled by a trusted company. Is the application vulnerable to these vulnerabilities given that HTTPS is always used?

  • What’s with this hardcoded server? Who controls it and how likely is it to trigger the vulnerabilities? – korrigan Feb 28 '18 at 11:23
  • @korrigan It is controlled by a trusted party (company). Let's suppose it is unlikely to be compromised. – vkrzv Feb 28 '18 at 11:29
1

HTTPS does not solve the problem

Judging from the linked description

  1. HTTP authentication leak in redirects - regardless of protocol, the client issues the custom Authorization: header when redirected.
  2. Specific to HTTP/2. May or may not be influenced by SSL

So, the advice would be as stated in the issue description: patch or upgrade your curl.

  • 1
    There’s an unknown in that there is only a single webserver the program communicates with. It is not known how likely it is to reply to the curl client in such fashion as to trigger the issues. You are strictly right on the protocol aspect but the question asks whether the particular application is susceptible to the issues. There isn’t enough detail to say for sure (as of writing) – korrigan Feb 28 '18 at 11:22
  • @korrigan, if there is not enough information, it is better to be on the safe side. And you can always use the proposed solution: update curl. – TimSparrow Feb 28 '18 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.