Stack-Based Buffer Overflow in libcurl Affects Various Products
CVE-2019-3822

7.1HIGH

Key Information:

Vendor

The Curl Project

Status
Curl
Vendor
CVE Published:
6 February 2019

What is CVE-2019-3822?

libcurl, specifically versions ranging from 7.36.0 to just before 7.64.0, contains a stack-based buffer overflow vulnerability. This occurs in the function responsible for crafting outgoing NTLM type-3 headers. Due to incorrect checks in the implementation, the function allows for the potential overflow of the local buffer when processing excessively large 'nt response' data received from a manipulated HTTP server. Mitigating this vulnerability is essential to prevent exploitation that could lead to significant disruptions or unauthorized access.

Affected Version(s)

curl 7.64.0

References

https://security.gentoo.org/glsa/201903-03
vendor-advisoryx_refsource_GENTOO
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822
x_refsource_CONFIRM
https://www.debian.org/security/2019/dsa-4386
vendor-advisoryx_refsource_DEBIAN

EPSS Score

33% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.