CVE-2024-7264
CVE-2024-7264 · ASN.1 date parser overread
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
CVSS 6.3 · Media · EPSS 20,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
curl
- Versiones
- ≥ 8.9.0, ≤ 8.9.0: Afectada (semver)
- ≥ 8.8.0, ≤ 8.8.0: Afectada (semver)
- ≥ 8.7.1, ≤ 8.7.1: Afectada (semver)
- ≥ 8.7.0, ≤ 8.7.0: Afectada (semver)
- ≥ 8.6.0, ≤ 8.6.0: Afectada (semver)
- ≥ 8.5.0, ≤ 8.5.0: Afectada (semver)
- ≥ 8.4.0, ≤ 8.4.0: Afectada (semver)
- ≥ 8.3.0, ≤ 8.3.0: Afectada (semver)
- ≥ 8.2.1, ≤ 8.2.1: Afectada (semver)
- ≥ 8.2.0, ≤ 8.2.0: Afectada (semver)
- ≥ 8.1.2, ≤ 8.1.2: Afectada (semver)
- ≥ 8.1.1, ≤ 8.1.1: Afectada (semver)
- ≥ 8.1.0, ≤ 8.1.0: Afectada (semver)
- ≥ 8.0.1, ≤ 8.0.1: Afectada (semver)
- ≥ 8.0.0, ≤ 8.0.0: Afectada (semver)
- ≥ 7.88.1, ≤ 7.88.1: Afectada (semver)
- ≥ 7.88.0, ≤ 7.88.0: Afectada (semver)
- ≥ 7.87.0, ≤ 7.87.0: Afectada (semver)
- ≥ 7.86.0, ≤ 7.86.0: Afectada (semver)
- ≥ 7.85.0, ≤ 7.85.0: Afectada (semver)
- ≥ 7.84.0, ≤ 7.84.0: Afectada (semver)
- ≥ 7.83.1, ≤ 7.83.1: Afectada (semver)
- ≥ 7.83.0, ≤ 7.83.0: Afectada (semver)
- ≥ 7.82.0, ≤ 7.82.0: Afectada (semver)
- ≥ 7.81.0, ≤ 7.81.0: Afectada (semver)
- ≥ 7.80.0, ≤ 7.80.0: Afectada (semver)
- ≥ 7.79.1, ≤ 7.79.1: Afectada (semver)
- ≥ 7.79.0, ≤ 7.79.0: Afectada (semver)
- ≥ 7.78.0, ≤ 7.78.0: Afectada (semver)
- ≥ 7.77.0, ≤ 7.77.0: Afectada (semver)
- ≥ 7.76.1, ≤ 7.76.1: Afectada (semver)
- ≥ 7.76.0, ≤ 7.76.0: Afectada (semver)
- ≥ 7.75.0, ≤ 7.75.0: Afectada (semver)
- ≥ 7.74.0, ≤ 7.74.0: Afectada (semver)
- ≥ 7.73.0, ≤ 7.73.0: Afectada (semver)
- ≥ 7.72.0, ≤ 7.72.0: Afectada (semver)
- ≥ 7.71.1, ≤ 7.71.1: Afectada (semver)
- ≥ 7.71.0, ≤ 7.71.0: Afectada (semver)
- ≥ 7.70.0, ≤ 7.70.0: Afectada (semver)
- ≥ 7.69.1, ≤ 7.69.1: Afectada (semver)
- ≥ 7.69.0, ≤ 7.69.0: Afectada (semver)
- ≥ 7.68.0, ≤ 7.68.0: Afectada (semver)
- ≥ 7.67.0, ≤ 7.67.0: Afectada (semver)
- ≥ 7.66.0, ≤ 7.66.0: Afectada (semver)
- ≥ 7.65.3, ≤ 7.65.3: Afectada (semver)
Sin corrección publicada
curl Debian:12
- Versiones
- 7.88.1-10
- 7.88.1-10+deb12u1
- 7.88.1-10+deb12u1~bpo11+1
- 7.88.1-10+deb12u2
- 7.88.1-10+deb12u3
- 7.88.1-10+deb12u3~bpo11+1
- 7.88.1-10+deb12u4
- 7.88.1-10+deb12u5
- 7.88.1-10+deb12u5~bpo11+1
- 7.88.1-10+deb12u6
- 7.88.1-10+deb12u6~bpo11+1
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.88.1-10+deb12u7
Actualiza a 7.88.1-10+deb12u7
curl Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 8.9.1-1
Actualiza a 8.9.1-1
curl Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 8.9.1-1
Actualiza a 8.9.1-1
curl Ubuntu:Pro:14.04:LTS
- Versiones
- 7.32.0-1ubuntu1
- 7.33.0-1ubuntu1
- 7.34.0-1ubuntu1
- 7.35.0-1ubuntu1
- 7.35.0-1ubuntu2
- 7.35.0-1ubuntu2.1
- 7.35.0-1ubuntu2.2
- 7.35.0-1ubuntu2.3
- 7.35.0-1ubuntu2.5
- 7.35.0-1ubuntu2.6
- 7.35.0-1ubuntu2.7
- 7.35.0-1ubuntu2.8
- 7.35.0-1ubuntu2.9
- 7.35.0-1ubuntu2.10
- 7.35.0-1ubuntu2.11
- 7.35.0-1ubuntu2.12
- 7.35.0-1ubuntu2.13
- 7.35.0-1ubuntu2.14
- 7.35.0-1ubuntu2.15
- 7.35.0-1ubuntu2.16
- 7.35.0-1ubuntu2.17
- 7.35.0-1ubuntu2.19
- 7.35.0-1ubuntu2.20
- 7.35.0-1ubuntu2.20+esm2
- 7.35.0-1ubuntu2.20+esm3
- 7.35.0-1ubuntu2.20+esm4
- 7.35.0-1ubuntu2.20+esm5
- 7.35.0-1ubuntu2.20+esm6
- 7.35.0-1ubuntu2.20+esm7
- 7.35.0-1ubuntu2.20+esm8
- 7.35.0-1ubuntu2.20+esm9
- 7.35.0-1ubuntu2.20+esm10
- 7.35.0-1ubuntu2.20+esm11
- 7.35.0-1ubuntu2.20+esm12
- 7.35.0-1ubuntu2.20+esm13
- 7.35.0-1ubuntu2.20+esm14
- 7.35.0-1ubuntu2.20+esm15
- 7.35.0-1ubuntu2.20+esm16
- 7.35.0-1ubuntu2.20+esm17
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.35.0-1ubuntu2.20+esm18
Actualiza a 7.35.0-1ubuntu2.20+esm18
curl Ubuntu:Pro:16.04:LTS
- Versiones
- 7.43.0-1ubuntu2
- 7.45.0-1ubuntu1
- 7.46.0-1ubuntu1
- 7.47.0-1ubuntu1
- 7.47.0-1ubuntu2
- 7.47.0-1ubuntu2.1
- 7.47.0-1ubuntu2.2
- 7.47.0-1ubuntu2.3
- 7.47.0-1ubuntu2.4
- 7.47.0-1ubuntu2.5
- 7.47.0-1ubuntu2.6
- 7.47.0-1ubuntu2.7
- 7.47.0-1ubuntu2.8
- 7.47.0-1ubuntu2.9
- 7.47.0-1ubuntu2.11
- 7.47.0-1ubuntu2.12
- 7.47.0-1ubuntu2.13
- 7.47.0-1ubuntu2.14
- 7.47.0-1ubuntu2.15
- 7.47.0-1ubuntu2.16
- 7.47.0-1ubuntu2.18
- 7.47.0-1ubuntu2.19
- 7.47.0-1ubuntu2.19+esm1
- 7.47.0-1ubuntu2.19+esm2
- 7.47.0-1ubuntu2.19+esm3
- 7.47.0-1ubuntu2.19+esm4
- 7.47.0-1ubuntu2.19+esm5
- 7.47.0-1ubuntu2.19+esm6
- 7.47.0-1ubuntu2.19+esm7
- 7.47.0-1ubuntu2.19+esm8
- 7.47.0-1ubuntu2.19+esm9
- 7.47.0-1ubuntu2.19+esm10
- 7.47.0-1ubuntu2.19+esm11
- 7.47.0-1ubuntu2.19+esm12
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.47.0-1ubuntu2.19+esm13
Actualiza a 7.47.0-1ubuntu2.19+esm13
curl Ubuntu:Pro:18.04:LTS
- Versiones
- 7.55.1-1ubuntu2
- 7.55.1-1ubuntu2.1
- 7.57.0-1ubuntu1
- 7.58.0-2ubuntu1
- 7.58.0-2ubuntu2
- 7.58.0-2ubuntu3
- 7.58.0-2ubuntu3.1
- 7.58.0-2ubuntu3.2
- 7.58.0-2ubuntu3.3
- 7.58.0-2ubuntu3.5
- 7.58.0-2ubuntu3.6
- 7.58.0-2ubuntu3.7
- 7.58.0-2ubuntu3.8
- 7.58.0-2ubuntu3.9
- 7.58.0-2ubuntu3.10
- 7.58.0-2ubuntu3.12
- 7.58.0-2ubuntu3.13
- 7.58.0-2ubuntu3.14
- 7.58.0-2ubuntu3.15
- 7.58.0-2ubuntu3.16
- 7.58.0-2ubuntu3.17
- 7.58.0-2ubuntu3.18
- 7.58.0-2ubuntu3.19
- 7.58.0-2ubuntu3.20
- 7.58.0-2ubuntu3.21
- 7.58.0-2ubuntu3.22
- 7.58.0-2ubuntu3.23
- 7.58.0-2ubuntu3.24
- 7.58.0-2ubuntu3.24+esm1
- 7.58.0-2ubuntu3.24+esm2
- 7.58.0-2ubuntu3.24+esm3
- 7.58.0-2ubuntu3.24+esm4
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.58.0-2ubuntu3.24+esm5
Actualiza a 7.58.0-2ubuntu3.24+esm5
curl Ubuntu:20.04:LTS
- Versiones
- 7.65.3-1ubuntu3
- 7.65.3-1ubuntu4
- 7.66.0-1ubuntu1
- 7.67.0-2ubuntu1
- 7.68.0-1ubuntu1
- 7.68.0-1ubuntu2
- 7.68.0-1ubuntu2.1
- 7.68.0-1ubuntu2.2
- 7.68.0-1ubuntu2.4
- 7.68.0-1ubuntu2.5
- 7.68.0-1ubuntu2.6
- 7.68.0-1ubuntu2.7
- 7.68.0-1ubuntu2.10
- 7.68.0-1ubuntu2.11
- 7.68.0-1ubuntu2.12
- 7.68.0-1ubuntu2.13
- 7.68.0-1ubuntu2.14
- 7.68.0-1ubuntu2.15
- 7.68.0-1ubuntu2.16
- 7.68.0-1ubuntu2.18
- 7.68.0-1ubuntu2.19
- 7.68.0-1ubuntu2.20
- 7.68.0-1ubuntu2.21
- 7.68.0-1ubuntu2.22
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.68.0-1ubuntu2.23
Actualiza a 7.68.0-1ubuntu2.23
curl Ubuntu:22.04:LTS
- Versiones
- 7.74.0-1.3ubuntu2
- 7.74.0-1.3ubuntu3
- 7.80.0-3
- 7.81.0-1
- 7.81.0-1ubuntu1.1
- 7.81.0-1ubuntu1.2
- 7.81.0-1ubuntu1.3
- 7.81.0-1ubuntu1.4
- 7.81.0-1ubuntu1.6
- 7.81.0-1ubuntu1.7
- 7.81.0-1ubuntu1.8
- 7.81.0-1ubuntu1.10
- 7.81.0-1ubuntu1.11
- 7.81.0-1ubuntu1.13
- 7.81.0-1ubuntu1.14
- 7.81.0-1ubuntu1.15
- 7.81.0-1ubuntu1.16
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.81.0-1ubuntu1.17
Actualiza a 7.81.0-1ubuntu1.17
curl Ubuntu:24.04:LTS
- Versiones
- 8.2.1-1ubuntu3
- 8.2.1-1ubuntu3.1
- 8.4.0-2ubuntu1
- 8.5.0-2ubuntu1
- 8.5.0-2ubuntu2
- 8.5.0-2ubuntu8
- 8.5.0-2ubuntu9
- 8.5.0-2ubuntu10
- 8.5.0-2ubuntu10.1
- Intervalos de versiones afectados
- ECOSYSTEM: < 8.5.0-2ubuntu10.2
Actualiza a 8.5.0-2ubuntu10.2
Fuentes originales
- https://curl.se/docs/CVE-2024-7264.json
- https://curl.se/docs/CVE-2024-7264.html
- https://hackerone.com/reports/2629968
- http://www.openwall.com/lists/oss-security/2024/07/31/1
- https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519
- https://security.netapp.com/advisory/ntap-20240828-0008/
- https://security.netapp.com/advisory/ntap-20241025-0010/
- https://security.netapp.com/advisory/ntap-20241025-0006/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-7264