A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.
Un servidor malicioso puede servir cantidades excesivas de encabezados "Set-Cookie:" en una respuesta HTTP a curl y curl versiones anteriores a 7.84.0 las almacena todas. Una cantidad suficientemente grande de cookies (grandes) hace que las subsiguientes peticiones HTTP a este, o a otros servidores con los que coincidan las cookies, creen peticiones que superen el umbral que curl usa internamente para evitar el envío de peticiones locamente grandes (1048576 bytes) y en su lugar devuelva un error. Este estado de denegación puede permanecer mientras sea mantenidas las mismas cookies, coincidan y no hayan expirado. Debido a las reglas de coincidencia de cookies, un servidor en "foo.example.com" puede establecer cookies que también coincidan para "bar.example.com", haciendo posible que un "servidor hermano" cause efectivamente una denegación de servicio para un sitio hermano en el mismo dominio de segundo nivel usando este método
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | LOW |
AV:N/AC:M/Au:N/C:N/I:N/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-770
|
| [email protected] | Primary |
en
CWE-770
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | * | <built-in method update of dict object at 0x7fd37039b540> | Application |
| fedoraproject | fedora | 35 | <built-in method update of dict object at 0x7fd36b232840> | Operating System |
| debian | debian_linux | 11.0 | <built-in method update of dict object at 0x7fd36be62fc0> | Operating System |
| netapp | clustered_data_ontap | - | <built-in method update of dict object at 0x7fd36be61a00> | Application |
| netapp | element_software | - | <built-in method update of dict object at 0x7fd37039a440> | Application |
| netapp | hci_management_node | - | <built-in method update of dict object at 0x7fd370399d40> | Application |
| netapp | solidfire | - | <built-in method update of dict object at 0x7fd369c0c1c0> | Application |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd34948c680> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd37039adc0> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd3703983c0> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd36be61f80> | Operating System |
| apple | macos | * | <built-in method update of dict object at 0x7fd37039bd00> | Operating System |
| siemens | scalance_sc622-2c_firmware | * | <built-in method update of dict object at 0x7fd34948ff00> | Operating System |
| siemens | scalance_sc626-2c_firmware | * | <built-in method update of dict object at 0x7fd319eb8680> | Operating System |
| siemens | scalance_sc632-2c_firmware | * | <built-in method update of dict object at 0x7fd369c0cf00> | Operating System |
| siemens | scalance_sc636-2c_firmware | * | <built-in method update of dict object at 0x7fd36be61e80> | Operating System |
| siemens | scalance_sc642-2c_firmware | * | <built-in method update of dict object at 0x7fd38677c2c0> | Operating System |
| siemens | scalance_sc646-2c_firmware | * | <built-in method update of dict object at 0x7fd34948dc80> | Operating System |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd36be62780> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd36be62940> | Application |
| splunk | universal_forwarder | 9.1.0 | <built-in method update of dict object at 0x7fd384a87e40> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:siemens:scalance_sc622-2c_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:siemens:scalance_sc622-2c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:siemens:scalance_sc626-2c_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:siemens:scalance_sc626-2c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:siemens:scalance_sc632-2c_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:siemens:scalance_sc632-2c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:siemens:scalance_sc636-2c_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:siemens:scalance_sc636-2c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:siemens:scalance_sc642-2c_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:siemens:scalance_sc642-2c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:siemens:scalance_sc646-2c_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:siemens:scalance_sc646-2c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |