CoreCVE
Back

MEDIUM

ASN.1 date parser overread

Published Jul 31, 2024

Description

libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.

This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.

Affected products

Remediation

Red Hat statement

The vulnerability is classified as low severity because it primarily results in a heap buffer over-read rather than a direct memory corruption or code execution risk. Since the ASN.1 parsing occurs after a successful TLS handshake, the malformed certificate must first bypass the TLS library's validation, which significantly reduces the likelihood of exploitation. Additionally, the impact is limited to a potential crash or unintended heap data exposure through CURLINFO_CERTINFO, but not arbitrary code execution. The requirement for a specific TLS backend configuration and the controlled nature of the memory read further minimize its exploitability.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat build of curl uses OpenSSL, which is not included in the affected list of GnuTLS, Schannel, Secure Transport and mbedTLS. Inspect which TLS backend is in use by running: $ curl --version Check the reference for curl handled by the maintainers which may contain more relevant information around this vulnerability.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (13)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner curl
Published Jul 31, 2024
Updated Nov 3, 2025
Reserved Jul 30, 2024
Link CVE-2024-7264
CISA Vulnrichment
Updated Aug 1, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2024-7264
Red Hat
Severity Low
Public date Jul 31, 2024
Links CVE-2024-7264 - Bugzilla