SB2023022750 - Ubuntu update for curl

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Use of uninitialized variable (CVE-ID: CVE-2021-22898)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of uninitialized variable in code, responsible for processing TELNET requests when parsing NEW_ENV variables. A remote attacker can force the affected application to connect to a telnet server under attackers control and read up to 1800 bytes from the uninitialized memory on the libcurl client system.

Proof of concept:

curl telnet://example.com -tNEW_ENV=a,bbbbbb (256 'b's)

2) Use of Uninitialized Variable (CVE-ID: CVE-2021-22925)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of uninitialized variable in code, responsible for processing TELNET requests when parsing NEW_ENV variables. A remote attacker can force the affected application to connect to a telnet server under attackers control and read up to 1800 bytes from the uninitialized memory on the libcurl client system.

3) Use-after-free (CVE-ID: CVE-2022-43552)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error while processing denied requests from HTTP proxies when using SMB or TELNET protocols. A remote attacker can trigger a use-after-free error and crash the application.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-5894-1