CVE-2023-38545

一、漏洞信息
 漏洞编号：[CVE-2023-38545](https://nvd.nist.gov/vuln/detail/CVE-2023-38545)
 漏洞归属组件：[curl](https://gitee.com/src-openeuler/curl)
 漏洞归属的版本：7.71.1,7.77.0,7.78.0,7.79.1,7.86.0,7.88.1,8.1.2
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  This flaw makes curl overflow a heap based buffer in the SOCKS5 proxyhandshake.When curl is asked to pass along the host name to the SOCKS5 proxy to allowthat to resolve the address instead of it getting done by curl itself, themaximum length that host name can be is 255 bytes.If the host name is detected to be longer, curl switches to local nameresolving and instead passes on the resolved address only. Due to this bug,the local variable that means  let the host resolve the name  could get thewrong value during a slow SOCKS5 handshake, and contrary to the intention,copy the too long host name to the target buffer instead of copying just theresolved address there.The target buffer being a heap based buffer, and the host name coming from theURL that curl has been told to operate with.
 漏洞公开时间：2023-10-18 04:15:11
 漏洞创建时间：2023-10-11 19:36:23
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-38545
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| support.hackerone.com | https://curl.se/docs/CVE-2023-38545.html |  |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5700 | https://bugzilla.redhat.com/show_bug.cgi?id=2241933 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5763 | https://bugzilla.redhat.com/show_bug.cgi?id=2241933 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-38545 |
| oracle |  | https://www.oracle.com/security-alerts/cpuoct2023.html |
| curl |  | https://curl.se/docs/CVE-2023-38545.html |
| gentoo |  | https://security.gentoo.org/glsa/202310-12 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-38545 |
| cve_search |  | https://curl.se/docs/CVE-2023-38545.html |
| mageia |  | http://advisories.mageia.org/MGASA-2023-0288.html |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-38545 | https://explore.alas.aws.amazon.com/CVE-2023-38545.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38545 | https://explore.alas.aws.amazon.com/CVE-2023-38545.html |
| snyk | https://github.com/curl/curl/discussions/12026 | https://security.snyk.io/vuln/SNYK-UNMANAGED-CURL-5931782 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| curl |  | https://github.com/curl/curl/commit/fb4415d8aee6c1 | https://github.com/curl/curl/commit/4a4b63daaa | curl |
| curl |  | https://curl.se/docs/CVE-2023-38545_patches.zip | https://github.com/curl/curl/commit/4a4b63daaa | curl |
| curl |  | https://github.com/curl/curl/commit/fb4415d8aee6c1 |  | curl |
| curl |  | https://curl.se/docs/CVE-2023-38545_patches.zip |  | curl |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
        当curl被要求将hostname传递给SOCKS5解析而不是由curl自己解析时，会限制hostname的最大长度为255个字节。如果hostname被检测到超长，curl就会切换到本地解析，最终只是把解析完的地址传递给代理。但是由于一个bug导致本地变量在慢速SOCKS5握手过程中可能会获取到错误值，将超长的hostname拷贝到目标缓冲区，而不是拷贝hostname解析后得到的地址，最终产生缓冲区溢出。   
 openEuler评分：
  7.5
 Vector：CVSS：2.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(7.71.1):受影响
2.openEuler-20.03-LTS-SP3(7.71.1):受影响
3.openEuler-20.03-LTS-SP4:受影响
4.openEuler-22.03-LTS(7.79.1):受影响
5.openEuler-22.03-LTS-SP1(7.79.1):受影响
6.openEuler-22.03-LTS-SP2(7.79.1):受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(7.71.1):否
2.openEuler-20.03-LTS-SP3(7.71.1):否
3.openEuler-20.03-LTS-SP4:否
4.openEuler-22.03-LTS(7.79.1):否
5.openEuler-22.03-LTS-SP1(7.79.1):否
6.openEuler-22.03-LTS-SP2(7.79.1):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2023-1762

src-openEuler/curl
Closed

Content Risk Flag

Comments (7)

src-openEuler/curlClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-38545

Comments (7)

Search

src-openEuler/curl
Closed