CVE-2022-43552 - curl: Use-after-free triggered by an HTTP proxy deny response

Back Back to CVE browser

MEDIUM

curl: Use-after-free triggered by an HTTP proxy deny response

Published Feb 9, 2023

5.9

MEDIUM

CVSS 3.1

EPSS 2.51%

Description

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Affected products

JBoss Core Services for RHEL 8

jbcs-httpd24-curl-0:8.0.1-1.el8jbcs

Fixed · RHSA-2023:3354
JBoss Core Services on RHEL 7

jbcs-httpd24-curl-0:8.0.1-1.el7jbcs

Fixed · RHSA-2023:3354
Red Hat Enterprise Linux 7

curl-0:7.29.0-59.el7_9.2

Fixed · RHSA-2023:7743
Red Hat Enterprise Linux 8

curl-0:7.61.1-30.el8

Fixed · RHSA-2023:2963
Red Hat Enterprise Linux 8.6 Extended Update Support

curl-0:7.61.1-22.el8_6.12

Fixed · RHSA-2024:0428
Red Hat Enterprise Linux 9

curl-0:7.76.1-23.el9

Fixed · RHSA-2023:2478
Red Hat Enterprise Linux 9

curl-0:7.76.1-23.el9

Fixed · RHSA-2023:2478
.NET Core 3.1 on Red Hat Enterprise Linux

rh-dotnet31-curl

Out of support scope
Red Hat Enterprise Linux 6

curl

Out of support scope

Product	Package	State	Advisory
JBoss Core Services for RHEL 8	jbcs-httpd24-curl-0:8.0.1-1.el8jbcs	Fixed	RHSA-2023:3354
JBoss Core Services on RHEL 7	jbcs-httpd24-curl-0:8.0.1-1.el7jbcs	Fixed	RHSA-2023:3354
Red Hat Enterprise Linux 7	curl-0:7.29.0-59.el7_9.2	Fixed	RHSA-2023:7743
Red Hat Enterprise Linux 8	curl-0:7.61.1-30.el8	Fixed	RHSA-2023:2963
Red Hat Enterprise Linux 8.6 Extended Update Support	curl-0:7.61.1-22.el8_6.12	Fixed	RHSA-2024:0428
Red Hat Enterprise Linux 9	curl-0:7.76.1-23.el9	Fixed	RHSA-2023:2478
Red Hat Enterprise Linux 9	curl-0:7.76.1-23.el9	Fixed	RHSA-2023:2478
.NET Core 3.1 on Red Hat Enterprise Linux	rh-dotnet31-curl	Out of support scope	n/a
Red Hat Enterprise Linux 6	curl	Out of support scope	n/a

Remediation

Red Hat statement

Potential successful exploitation will cause the curl to crash, which generates a low impact to the environment where the curl is used. Additionally, exploitation depends on the conditions that are out of the attacker's control, like usage of specific protocols (SMB or TELNET) and HTTP proxy tunnels at the same time. Due to these facts, this vulnerability has been classified as a Low severity issue.

Red Hat mitigation

Avoid using the SMB and TELNET protocols.

Weaknesses (1)

CWE-416

Use After Free

References (11)

http://seclists.org/fulldisclosure/2023/Mar/17
mailing-listMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2022-43552
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2152652
Issue Tracking
https://curl.se/docs/CVE-2022-43552.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46549
Advisory
https://hackerone.com/reports/1764858
ExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-43552
https://security.gentoo.org/glsa/202310-12
vendor-advisoryThird Party Advisory
https://security.netapp.com/advisory/ntap-20230214-0002/
Vendor Advisory
https://support.apple.com/kb/HT213670
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-43552

Link	Providers	Tags
http://seclists.org/fulldisclosure/2023/Mar/17		mailing-listMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2022-43552		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2152652		Issue Tracking
https://curl.se/docs/CVE-2022-43552.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46549		Advisory
https://hackerone.com/reports/1764858		ExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-43552
https://security.gentoo.org/glsa/202310-12		vendor-advisoryThird Party Advisory
https://security.netapp.com/advisory/ntap-20230214-0002/		Vendor Advisory
https://support.apple.com/kb/HT213670		Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-43552