Homepage
About Snyk

Double Free Affecting libcurl package, versions <0:7.79.1-7.amzn2.0.1

medium

Snyk CVSS

    Attack Complexity High
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.54% (77th percentile)
Expand this section
NVD
8.1 high
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-AMZN2-LIBCURL-3159969
  • published 7 Dec 2022
  • disclosed 29 Oct 2022
Report a new vulnerability Found a mistake?

Introduced: 29 Oct 2022

CVE-2022-42915 Open this link in a new tab
CWE-415 Open this link in a new tab

How to fix?

Upgrade Amazon-Linux:2 libcurl to version 0:7.79.1-7.amzn2.0.1 or higher.
This issue was patched in ALAS2-2022-1882.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2 relevant fixed versions and status.

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.

References