Announcement

Collapse
No announcement yet.

Curl & Libcurl Package updates

Collapse
X
Collapse
 
  • Page of 1
  • Filter
  • Time
  • Show
Clear All
new posts
Previous template Next
  • #1

    Curl & Libcurl Package updates

    Hi Team,

    We have started to recieve a large number of reports from PCI scans in relation to the below packages which are provided as part of the Imunify360 Installation from your repository.

    alt-curlssl11-7.87.0-1.el7.x86_64
    alt-libcurlssl11-7.87.0-1.el7.x86_64

    The vulnerability appears to be in relation to the below.

    VULNERABILITY

    This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.

    When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.
    ​
    Upon investigation it appears this is likely related to the below CVE

    curl - SOCKS5 heap buffer overflow - CVE-2023-38545
    https://curl.se/docs/CVE-2023-38545.html#:~:text=VULNERABILITY,can%20be%20is%20255%20bytes

    cve-details
    https://access.redhat.com/security/cve/cve-2023-38545


    The servers in question are largely running CentOS7 and not Cloud Linux so may not be vulnerable based on the Redhat post.

    Could you please review and confirm if they are vulnerable and is so will a patch be be in development

    Thanks in advance.
    Tags: None
  • #2
    Hi,

    We have got a confirmation from our developers that CentOS7 servers are not affected.

    Comment

    • #3
      Thank you for responding and confirming. I now have another.

      We've stated getting reports for the below which is provided by the same package provided as part of Imunify360.

      The remote libcurl install is affected by a cookie injection vulnerability.
      libcurl 7.9.1 < 8.4.0 Cookie Injection


      The version of libcurl installed on the remote host is affected by a cookie injection vulnerability. This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

      libcurl performs transfers. In its API, an application creates 'easy handles' that are the individual handles for single transfers.

      libcurl provides a function call that duplicates an easy handle called curl_easy_duphandle.

      If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

      Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.​

      Path : /opt/alt/curl/usr/lib64/libcurl.so.4.5.0
      Installed version : 7.64.0
      Fixed version : 8.4.0

      This issue does appear to have been marked as outside of support scope by Redhat at https://access.redhat.com/security/cve/cve-2023-38546. Could you please confirm if this is going to be reviewed within your provided package or not addressed?

      Thanks in advance.
      ​

      Comment

      • #4
        Will clarify the information and get back to you.

        Comment

        • #5
          Hello,

          I am writing to update that the package has been released and is available from the beta repository:
          Code:
          yum update alt-libcurlssl11 --enablerepo=cloudlinux-updates-testing
          Otherwise you might want to wait 2 weeks to have it available in stable.

          ALTPHP-1634: Fixes for CVE-2023-38545 and CVE-2023-38546.

          Comment

          • #6
            After performing the curl update, I can't seem to build or update any packages. DirectAdmin's CustomBuild is telling me there's an update available for MariaDB from 8.0.32 to 10.6.16. When I try to update MariaDB, I get the following:

            download_cached: downloading 'https://mirror.mariadb.org/yum/10.6/centos/8/x86_64/rpms/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/cache/MariaDB-client-10.6.16-1.el8.x86_64.rpm'

            curl: (48) An unknown option was passed in to libcurl

            safe_download: downloading 'https://mirror.mariadb.org/yum/10.6/centos/8/x86_64/rpms/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (0/3)

            curl: (48) An unknown option was passed in to libcurl

            safe_download: downloading 'https://files.directadmin.com/services/all/mariadb/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (0/3)

            curl: (48) An unknown option was passed in to libcurl

            safe_download: downloading 'https://mirror.mariadb.org/yum/10.6/centos/8/x86_64/rpms/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (1/3)

            curl: (48) An unknown option was passed in to libcurl

            safe_download: downloading 'https://files.directadmin.com/services/all/mariadb/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (1/3)

            curl: (48) An unknown option was passed in to libcurl

            safe_download: downloading 'https://mirror.mariadb.org/yum/10.6/centos/8/x86_64/rpms/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (2/3)

            curl: (48) An unknown option was passed in to libcurl

            safe_download: downloading 'https://files.directadmin.com/services/all/mariadb/MariaDB-client-10.6.16-1.el8.x86_64.rpm' to '/usr/local/directadmin/custombuild/tmp/tmp.4H4IN94C17.safe_download' failed (2/3)




            ​curl --version gives:

            curl 8.5.0 (x86_64-pc-linux-gnu) libcurl/7.61.1 (additional stuff here)

            Release-Date: 2023-12-06

            Features: (bunch of stuff here)

            WARNING: curl and libcurl versions do not match. Functionality may be affected.

            ​===

            I assume I'm experiencing part of the "functionality may be affected" warning.

            Currently running CloudLinux 8.9

            Updated Curl using "yum update alt-libcurlssl11 --enablerepo=cloudlinux-updates-testing"

            Updated due to this post: https://forum.cloudlinux.com/forum/c...ackage-updates

            running "yum update curl*" reports there's "nothing to do".

            I'm seeing this Curl 48 error on anything I try to update, not just building MariaDB.

            Any assistance is greatly appreciated.
            ​

            Comment

            • #7
              Hmm, is it curl installed with a system or one provided by DirectAdmin? Checking the lab servers and cannot reproduce. Here are some command I would like to see from your server:

              Code:
              # which curl
/usr/bin/curl
​
# rpm -qf /usr/bin/curl
curl-7.29.0-59.el7_9.2.x86_64​

# ldd /usr/bin/curl | grep libcurl.so.4
  libcurl.so.4 => /lib64/libcurl.so.4 (0x00007fb013909000)

# rpm -ql alt-libcurlssl11-7.87.0-2.el7.x86_64
/opt/alt/curlssl11/usr/lib64/libcurl.so.4
/opt/alt/curlssl11/usr/lib64/libcurl.so.4.8.0​

# ldd /opt/alt/curl/usr/bin/curl | grep libcurl.so.4
  libcurl.so.4 => /opt/alt/curl/usr/lib64/libcurl.so.4 (0x00007f70a0cac000)​

              Comment

              • #8
                I wound up rolling back curl to match libcurl's version (7.61.1) to resolve the issue. Thank you for your assistance
                • Likes 1

                Comment

                Previous template Next
                Working...
                X