cURL 7.65.2 Retry Delay tool_operate.c integer overflow ⚔ [Disputed]

Summaryinfo

A vulnerability was found in cURL 7.65.2. It has been classified as problematic. This affects an unknown part of the file tool_operate.c of the component Retry Delay Handler. The manipulation leads to integer overflow. This vulnerability is uniquely identified as CVE-2020-19909. No exploit exists. There is ongoing doubt regarding the real existence of this vulnerability. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in cURL 7.65.2 (Network Utility Software) and classified as problematic. This issue affects an unknown code block of the file tool_operate.c of the component Retry Delay Handler. The manipulation with an unknown input leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. The impact remains unknown. The summary by CVE is:

Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error.

The weakness was disclosed 08/23/2023. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2020-19909 since 08/13/2020. Technical details of the vulnerability are known, but there is no available exploit.

The real existence of this vulnerability is still doubted at the moment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2020-11805). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Network Utility Software

Name

• cURL

Version

• 7.65.2

License

• open-source

Website

• Product: https://github.com/curl/curl/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion