PT-2017-18551 · Curl+3 · Libcurl+4
Published
2017-11-29
·
Updated
2026-05-18
·
CVE-2017-8817
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libcurl versions prior to 7.57.0
curl versions prior to 7.57.0
Description
The issue is related to the FTP wildcard function in libcurl and curl, which can cause a denial of service (out-of-bounds read and application crash) or possibly have other unspecified impacts. This occurs when a string that ends with an
[ character is used. The built-in wildcard function in libcurl does not detect the end of the pattern string if it ends with an open bracket, causing it to continue reading beyond the end of the URL buffer. This flaw can be triggered by malicious servers that redirect clients to a URL using such a wildcard pattern, especially in applications that use HTTP(S) URLs and have FTP wildcards enabled.Recommendations
For libcurl versions prior to 7.57.0, update to version 7.57.0 or later to resolve the issue.
For curl versions prior to 7.57.0, update to version 7.57.0 or later to resolve the issue.
As a temporary workaround, consider disabling the
CURLOPT WILDCARDMATCH option until a patch is available.Exploit
Fix
DoS
Buffer Over-read
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Suse
Ubuntu
Curl
Libcurl