PT-2018-9297 · Curl+5 · Curl+5
Dario Weisser
·
Publicado
2018-03-14
·
Atualizado
2026-05-18
·
CVE-2018-1000121
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
curl versions 7.21.0 through 7.58.0
Description:
A NULL pointer dereference issue exists in the LDAP code, allowing an attacker to cause a denial of service. The
ldap get attribute ber() function can return a NULL pointer in the result pointer when getting a particularly crafted response, which can cause libcurl-using applications to crash. This issue affects applications that allow LDAP URLs or redirects to LDAP URLs.Recommendations:
For curl versions 7.21.0 through 7.58.0, consider disabling LDAP URL support as a temporary workaround until a patch is available. Restrict access to LDAP URLs to minimize the risk of exploitation. Avoid using the
ldap get attribute ber() function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
NULL Pointer Dereference
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Curl