curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
curl versiones 7.7 hasta 7.76.1 sufre de una divulgacion de información cuando la opción de línea de comandos "-t", conocida como "CURLOPT_TELNETOPTIONS" en libcurl, se usa para enviar pares de variables=contenido a servidores TELNET. Debido a un fallo en el analizador de opciones para el envío de variables NEW_ENV, podría hacer que libcurl pasara datos no inicializados de un búfer basado en la pila al servidor, resultando en una potencial divulgación de información interna confidencial al servidor que usaba un protocolo de red de texto sin cifrar
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | NONE |
| Availability Impact | NONE |
AV:N/AC:H/Au:N/C:P/I:N/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | HIGH |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | NONE |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-200
|
| [email protected] | Primary |
en
CWE-909
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | * | <built-in method update of dict object at 0x7fd36b118040> | Application |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7fd36b119a40> | Operating System |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd36b119a80> | Operating System |
| fedoraproject | fedora | 34 | <built-in method update of dict object at 0x7fd36b11ad40> | Operating System |
| oracle | communications_cloud_native_core_binding_support_function | 1.11.0 | <built-in method update of dict object at 0x7fd36b11a6c0> | Application |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | <built-in method update of dict object at 0x7fd36b1194c0> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 1.15.0 | <built-in method update of dict object at 0x7fd36b11bd40> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 1.15.1 | <built-in method update of dict object at 0x7fd36960c640> | Application |
| oracle | communications_cloud_native_core_network_slice_selection_function | 1.8.0 | <built-in method update of dict object at 0x7fd36b434d80> | Application |
| oracle | communications_cloud_native_core_service_communication_proxy | 1.15.0 | <built-in method update of dict object at 0x7fd36b119040> | Application |
| oracle | essbase | * | <built-in method update of dict object at 0x7fd341787e00> | Application |
| oracle | essbase | * | <built-in method update of dict object at 0x7fd36b118940> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd36b118cc0> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd36b11a940> | Application |
| siemens | sinec_infrastructure_network_services | * | <built-in method update of dict object at 0x7fd36971e7c0> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd340a91540> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd36b118dc0> | Application |
| splunk | universal_forwarder | 9.1.0 | <built-in method update of dict object at 0x7fd36b118400> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |