curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.
References
| Link | Resource |
|---|---|
| http://seclists.org/fulldisclosure/2023/Jan/19 | Mailing List Third Party Advisory |
| http://seclists.org/fulldisclosure/2023/Jan/20 | Mailing List Third Party Advisory |
| https://hackerone.com/reports/1721098 | Exploit Patch Third Party Advisory |
| https://security.gentoo.org/glsa/202212-01 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230110-0006/ | Third Party Advisory |
| https://support.apple.com/kb/HT213604 | Third Party Advisory |
| https://support.apple.com/kb/HT213605 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
|
Configuration 8 (hide)
|
History
No history.
Information
Published : 2022-12-05 22:15
Updated : 2024-03-27 15:00
NVD link : CVE-2022-35260
Mitre link : CVE-2022-35260
CVE.ORG link : CVE-2022-35260
JSON object : View
Products Affected
splunk
- universal_forwarder
apple
- macos
netapp
- h300s_firmware
- h410s_firmware
- clustered_data_ontap
- h500s
- h500s_firmware
- h700s_firmware
- h300s
- h700s
- h410s
haxx
- curl