When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
Al realizar transferencias HTTP(S), libcurl podría usar erróneamente la devolución de llamada de lectura (`CURLOPT_READFUNCTION`) para solicitar datos para enviar, incluso cuando se haya configurado la opción `CURLOPT_POSTFIELDS`, si anteriormente se usó el mismo identificador para emitir un `PUT `solicitud que utilizó esa devolución de llamada. Esta falla puede sorprender a la aplicación y hacer que se comporte mal y envíe datos incorrectos o use memoria después de liberarla o algo similar en la solicitud "POST" posterior. El problema existe en la lógica de un identificador reutilizado cuando se cambia de PUT a POST.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-200
|
| [email protected] | Primary |
en
CWE-668
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | * | <built-in method update of dict object at 0x7fd340a90580> | Application |
| netapp | clustered_data_ontap | - | <built-in method update of dict object at 0x7fd36a715840> | Application |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd2dbe0c640> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd3845fde40> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd340a92240> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd340a93480> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd38544bf80> | Operating System |
| debian | debian_linux | 11.0 | <built-in method update of dict object at 0x7fd340dad600> | Operating System |
| apple | macos | * | <built-in method update of dict object at 0x7fd38544b8c0> | Operating System |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd340a91680> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd36a715e40> | Application |
| splunk | universal_forwarder | 9.1.0 | <built-in method update of dict object at 0x7fd36a714b00> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |