When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
Cuando se le solicita a libcurl que realice una descompresión gzip automática de respuestas HTTP codificadas con contenido con la opción `CURLOPT_ACCEPT_ENCODING`, **usando zlib 1.2.0.3 o anterior**, un desbordamiento de entero controlado por un atacante haría que libcurl realice un desbordamiento de búfer.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | LOW |
| Availability Impact | LOW |
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Type: Secondary
Exploitability Score: 3.9
Impact Score: 3.4
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-120
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| netapp | hci_baseboard_management_controller | - | <built-in method update of dict object at 0x7fd3695d8f00> | Application |
| netapp | hci_h610s_firmware | - | <built-in method update of dict object at 0x7fd3840e70c0> | Operating System |
| netapp | hci_h610c_firmware | - | <built-in method update of dict object at 0x7fd385692540> | Operating System |
| netapp | hci_h615c_firmware | - | <built-in method update of dict object at 0x7fd340cc7740> | Operating System |
| netapp | solidfire_\&_hci_management_node | - | <built-in method update of dict object at 0x7fd3695dac40> | Application |
| netapp | solidfire_\&_hci_storage_node | - | <built-in method update of dict object at 0x7fd3695da340> | Application |
| haxx | curl | * | <built-in method update of dict object at 0x7fd2db241300> | Application |
| haxx | libcurl | * | <built-in method update of dict object at 0x7fd2dbcdc580> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:hci_h610s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:hci_h610s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:hci_h610c_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:hci_h610c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:hci_h615c_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:hci_h615c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:* |