CVE-2024-2398
CVE-2024-2398 · HTTP/2 push headers memory-leak
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
CVSS 8.6 · Élevée · EPSS 36,1% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
curl
- Versions du logiciel
- ≥ 8.6.0, ≤ 8.6.0: Concernée (semver)
- ≥ 8.5.0, ≤ 8.5.0: Concernée (semver)
- ≥ 8.4.0, ≤ 8.4.0: Concernée (semver)
- ≥ 8.3.0, ≤ 8.3.0: Concernée (semver)
- ≥ 8.2.1, ≤ 8.2.1: Concernée (semver)
- ≥ 8.2.0, ≤ 8.2.0: Concernée (semver)
- ≥ 8.1.2, ≤ 8.1.2: Concernée (semver)
- ≥ 8.1.1, ≤ 8.1.1: Concernée (semver)
- ≥ 8.1.0, ≤ 8.1.0: Concernée (semver)
- ≥ 8.0.1, ≤ 8.0.1: Concernée (semver)
- ≥ 8.0.0, ≤ 8.0.0: Concernée (semver)
- ≥ 7.88.1, ≤ 7.88.1: Concernée (semver)
- ≥ 7.88.0, ≤ 7.88.0: Concernée (semver)
- ≥ 7.87.0, ≤ 7.87.0: Concernée (semver)
- ≥ 7.86.0, ≤ 7.86.0: Concernée (semver)
- ≥ 7.85.0, ≤ 7.85.0: Concernée (semver)
- ≥ 7.84.0, ≤ 7.84.0: Concernée (semver)
- ≥ 7.83.1, ≤ 7.83.1: Concernée (semver)
- ≥ 7.83.0, ≤ 7.83.0: Concernée (semver)
- ≥ 7.82.0, ≤ 7.82.0: Concernée (semver)
- ≥ 7.81.0, ≤ 7.81.0: Concernée (semver)
- ≥ 7.80.0, ≤ 7.80.0: Concernée (semver)
- ≥ 7.79.1, ≤ 7.79.1: Concernée (semver)
- ≥ 7.79.0, ≤ 7.79.0: Concernée (semver)
- ≥ 7.78.0, ≤ 7.78.0: Concernée (semver)
- ≥ 7.77.0, ≤ 7.77.0: Concernée (semver)
- ≥ 7.76.1, ≤ 7.76.1: Concernée (semver)
- ≥ 7.76.0, ≤ 7.76.0: Concernée (semver)
- ≥ 7.75.0, ≤ 7.75.0: Concernée (semver)
- ≥ 7.74.0, ≤ 7.74.0: Concernée (semver)
- ≥ 7.73.0, ≤ 7.73.0: Concernée (semver)
- ≥ 7.72.0, ≤ 7.72.0: Concernée (semver)
- ≥ 7.71.1, ≤ 7.71.1: Concernée (semver)
- ≥ 7.71.0, ≤ 7.71.0: Concernée (semver)
- ≥ 7.70.0, ≤ 7.70.0: Concernée (semver)
- ≥ 7.69.1, ≤ 7.69.1: Concernée (semver)
- ≥ 7.69.0, ≤ 7.69.0: Concernée (semver)
- ≥ 7.68.0, ≤ 7.68.0: Concernée (semver)
- ≥ 7.67.0, ≤ 7.67.0: Concernée (semver)
- ≥ 7.66.0, ≤ 7.66.0: Concernée (semver)
- ≥ 7.65.3, ≤ 7.65.3: Concernée (semver)
- ≥ 7.65.2, ≤ 7.65.2: Concernée (semver)
- ≥ 7.65.1, ≤ 7.65.1: Concernée (semver)
- ≥ 7.65.0, ≤ 7.65.0: Concernée (semver)
- ≥ 7.64.1, ≤ 7.64.1: Concernée (semver)
Aucun correctif publié
curl Debian:12
- Versions du logiciel
- 7.88.1-10
- 7.88.1-10+deb12u1
- 7.88.1-10+deb12u1~bpo11+1
- 7.88.1-10+deb12u2
- 7.88.1-10+deb12u3
- 7.88.1-10+deb12u3~bpo11+1
- 7.88.1-10+deb12u4
- 7.88.1-10+deb12u5
- 7.88.1-10+deb12u5~bpo11+1
- 7.88.1-10+deb12u6~bpo11+1
- Plages de versions concernées
- ECOSYSTEM: < 7.88.1-10+deb12u6
Mettez à jour vers 7.88.1-10+deb12u6
curl Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 8.7.1-1
Mettez à jour vers 8.7.1-1
curl Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 8.7.1-1
Mettez à jour vers 8.7.1-1
curl Ubuntu:Pro:16.04:LTS
- Versions du logiciel
- 7.43.0-1ubuntu2
- 7.45.0-1ubuntu1
- 7.46.0-1ubuntu1
- 7.47.0-1ubuntu1
- 7.47.0-1ubuntu2
- 7.47.0-1ubuntu2.1
- 7.47.0-1ubuntu2.2
- 7.47.0-1ubuntu2.3
- 7.47.0-1ubuntu2.4
- 7.47.0-1ubuntu2.5
- 7.47.0-1ubuntu2.6
- 7.47.0-1ubuntu2.7
- 7.47.0-1ubuntu2.8
- 7.47.0-1ubuntu2.9
- 7.47.0-1ubuntu2.11
- 7.47.0-1ubuntu2.12
- 7.47.0-1ubuntu2.13
- 7.47.0-1ubuntu2.14
- 7.47.0-1ubuntu2.15
- 7.47.0-1ubuntu2.16
- 7.47.0-1ubuntu2.18
- 7.47.0-1ubuntu2.19
- 7.47.0-1ubuntu2.19+esm1
- 7.47.0-1ubuntu2.19+esm2
- 7.47.0-1ubuntu2.19+esm3
- 7.47.0-1ubuntu2.19+esm4
- 7.47.0-1ubuntu2.19+esm5
- 7.47.0-1ubuntu2.19+esm6
- 7.47.0-1ubuntu2.19+esm7
- 7.47.0-1ubuntu2.19+esm8
- 7.47.0-1ubuntu2.19+esm9
- 7.47.0-1ubuntu2.19+esm10
- 7.47.0-1ubuntu2.19+esm11
- Plages de versions concernées
- ECOSYSTEM: < 7.47.0-1ubuntu2.19+esm12
Mettez à jour vers 7.47.0-1ubuntu2.19+esm12
curl Ubuntu:Pro:18.04:LTS
- Versions du logiciel
- 7.55.1-1ubuntu2
- 7.55.1-1ubuntu2.1
- 7.57.0-1ubuntu1
- 7.58.0-2ubuntu1
- 7.58.0-2ubuntu2
- 7.58.0-2ubuntu3
- 7.58.0-2ubuntu3.1
- 7.58.0-2ubuntu3.2
- 7.58.0-2ubuntu3.3
- 7.58.0-2ubuntu3.5
- 7.58.0-2ubuntu3.6
- 7.58.0-2ubuntu3.7
- 7.58.0-2ubuntu3.8
- 7.58.0-2ubuntu3.9
- 7.58.0-2ubuntu3.10
- 7.58.0-2ubuntu3.12
- 7.58.0-2ubuntu3.13
- 7.58.0-2ubuntu3.14
- 7.58.0-2ubuntu3.15
- 7.58.0-2ubuntu3.16
- 7.58.0-2ubuntu3.17
- 7.58.0-2ubuntu3.18
- 7.58.0-2ubuntu3.19
- 7.58.0-2ubuntu3.20
- 7.58.0-2ubuntu3.21
- 7.58.0-2ubuntu3.22
- 7.58.0-2ubuntu3.23
- 7.58.0-2ubuntu3.24
- 7.58.0-2ubuntu3.24+esm1
- 7.58.0-2ubuntu3.24+esm2
- 7.58.0-2ubuntu3.24+esm3
- Plages de versions concernées
- ECOSYSTEM: < 7.58.0-2ubuntu3.24+esm4
Mettez à jour vers 7.58.0-2ubuntu3.24+esm4
curl Ubuntu:20.04:LTS
- Versions du logiciel
- 7.65.3-1ubuntu3
- 7.65.3-1ubuntu4
- 7.66.0-1ubuntu1
- 7.67.0-2ubuntu1
- 7.68.0-1ubuntu1
- 7.68.0-1ubuntu2
- 7.68.0-1ubuntu2.1
- 7.68.0-1ubuntu2.2
- 7.68.0-1ubuntu2.4
- 7.68.0-1ubuntu2.5
- 7.68.0-1ubuntu2.6
- 7.68.0-1ubuntu2.7
- 7.68.0-1ubuntu2.10
- 7.68.0-1ubuntu2.11
- 7.68.0-1ubuntu2.12
- 7.68.0-1ubuntu2.13
- 7.68.0-1ubuntu2.14
- 7.68.0-1ubuntu2.15
- 7.68.0-1ubuntu2.16
- 7.68.0-1ubuntu2.18
- 7.68.0-1ubuntu2.19
- 7.68.0-1ubuntu2.20
- 7.68.0-1ubuntu2.21
- Plages de versions concernées
- ECOSYSTEM: < 7.68.0-1ubuntu2.22
Mettez à jour vers 7.68.0-1ubuntu2.22
curl Ubuntu:22.04:LTS
- Versions du logiciel
- 7.74.0-1.3ubuntu2
- 7.74.0-1.3ubuntu3
- 7.80.0-3
- 7.81.0-1
- 7.81.0-1ubuntu1.1
- 7.81.0-1ubuntu1.2
- 7.81.0-1ubuntu1.3
- 7.81.0-1ubuntu1.4
- 7.81.0-1ubuntu1.6
- 7.81.0-1ubuntu1.7
- 7.81.0-1ubuntu1.8
- 7.81.0-1ubuntu1.10
- 7.81.0-1ubuntu1.11
- 7.81.0-1ubuntu1.13
- 7.81.0-1ubuntu1.14
- 7.81.0-1ubuntu1.15
- Plages de versions concernées
- ECOSYSTEM: < 7.81.0-1ubuntu1.16
Mettez à jour vers 7.81.0-1ubuntu1.16
curl Ubuntu:24.04:LTS
- Versions du logiciel
- 8.2.1-1ubuntu3
- 8.2.1-1ubuntu3.1
- 8.4.0-2ubuntu1
- 8.5.0-2ubuntu1
- 8.5.0-2ubuntu2
- 8.5.0-2ubuntu8
- 8.5.0-2ubuntu9
- 8.5.0-2ubuntu10
- Plages de versions concernées
- ECOSYSTEM: < 8.5.0-2ubuntu10.1
Mettez à jour vers 8.5.0-2ubuntu10.1
Sources originales
- https://curl.se/docs/CVE-2024-2398.json
- https://curl.se/docs/CVE-2024-2398.html
- https://hackerone.com/reports/2402845
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
- http://www.openwall.com/lists/oss-security/2024/03/27/3
- https://security.netapp.com/advisory/ntap-20240503-0009/
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214118
- https://support.apple.com/kb/HT214120
- http://seclists.org/fulldisclosure/2024/Jul/20
- http://seclists.org/fulldisclosure/2024/Jul/18
- http://seclists.org/fulldisclosure/2024/Jul/19
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-417159.html
- https://cert-portal.siemens.com/productcert/html/ssa-331112.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-2398