High Vulnerability - Curl 7.69 < 8.4.0 Heap Buffer Overflow - CVE-2023-38545

[tbobrykozaki]

Found using Tenable.io within FEDRAMP environment

Mirth Docker Container Version : 4.4.0 OS : RHEL 8.8 Server: Docker Engine - Community Engine: Version: 24.0.6 API version: 1.43 (minimum version 1.12) Go version: go1.20.7 Built: Mon Sep 4 12:32:10 2023 OS/Arch: linux/amd64 Experimental: false containerd: Version: 1.6.24 runc: Version: 1.1.9 docker-init: Version: 0.19.0

Output from Tenable.io

Path : /var/lib/docker/overlay2/56a86609a5c358b00335308a359f1488f072a6334a2581efff2500ec3ef757ee/diff/usr/bin/curl Installed version : 7.81.0 Fixed version : 8.4.0

Path : /var/lib/docker/overlay2/538f1407aefec940f4e6545473576e2d6069d3eed266467b27bf384ccc67ad5d/merged/usr/bin/curl Installed version : 7.81.0 Fixed version : 8.4.0

Description The version of curl installed on the remote host is affected by a heap based buffer overflow in the SOCKS5 proxy handshake.

When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.

If the hostname is detected to be longer than 255 bytes, curl switches to local name resolving and instead passes on the resolved address only to the proxy. Due to a bug, the local variable that means 'let the host resolve the name' could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long hostname to the target buffer instead of copying just the resolved address there.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

VPR Key Drivers THREAT RECENCY 1 to 7 days THREAT INTENSITY Very High EXPLOIT CODE MATURITY Unproven AGE OF VULN days + PRODUCT COVERAGE UNKNOWN CVSSV3 IMPACT SCORE 3.6 THREAT SOURCES Social Media Risk Information VULNERABILITY PRIORITY RATING (VPR) 6.9 RISK FACTOR High CVSS BASE SCORE 7.8 CVSS TEMPORAL SCORE 5.8 CVSS VECTOR AV:N/AC:L/Au:N/C:N/I:N/A:C CVSS TEMPORAL VECTOR E:U/RL:OF/RC:C CVSS3 BASE SCORE 7.5 CVSS3 TEMPORAL SCORE 6.5 CVSS3 VECTOR AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS3 TEMPORAL VECTOR E:U/RL:O/RC:C IVAM SEVERITY I Vulnerability Information VULN PUBLISHED 10/10/2023 at 05:00 PM EXPLOITABILITY PATCH PUBLISHED 10/10/2023 at 05:00 PM CPE cpe:/a:haxx:curl Reference Information CVE CVE-2023-38545 IAVA 2023-A-0531