The vulnerability of the utf8asn1str() function in the ASN1 parser’s command-line utility cURL allows a attacker to execute arbitrary code or cause a service failure.

🗓️ 07 Aug 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Vulnerability in utf8asn1str() of curl ASN1 parser enables memory release during UTF-8 processing.

Reporter	Title	Published	Views	Family All 96
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities	11 Sep 202408:43	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to stack overwrite due to the libcurl package (CVE-2024-6197)	2 Sep 202514:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2024.	15 Apr 202502:56	–	ibm
IBM Security Bulletins	Security Bulletin: PowerSC is vulnerable to information disclosure, denial of service, and security restrictions bypass due to Curl	4 Dec 202422:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty, OpenSSL, libcurl, IBM Java, and IBM Storage Protect Backup-Archive Client may affect IBM Storage Protect Backup-Archive Client	18 Oct 202412:50	–	ibm
AlpineLinux	CVE-2024-6197	24 Jul 202407:29	–	alpinelinux
CBLMariner	CVE-2024-6197 affecting package curl for versions less than 8.8.0-2	15 Oct 202418:24	–	cbl_mariner
CBLMariner	CVE-2024-6197 affecting package cmake for versions less than 3.30.3-2	1 Oct 202418:58	–	cbl_mariner
CBLMariner	CVE-2024-6197 affecting package curl for versions less than 8.8.0-2	12 Sep 202423:01	–	cbl_mariner
Circl	CVE-2024-6197	24 Jul 202410:47	–	circl

Vulners

Node

daniel_stenberg curlRange8.6.0–8.8.0aurora

OR

microsoft cbl_marinerMatch2.0

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/07/24/1
openwall	www.openwall.com/lists/oss-security/2024/07/24/5
curl	www.curl.se/docs/CVE-2024-6197.html
curl	www.curl.se/docs/CVE-2024-6197.json
hackerone	www.hackerone.com/reports/2559516
github	www.github.com/curl/curl/commit/3a537a4db9e65e545ec45b1b5d5575ee09a2569d
github	www.github.com/curl/curl/commit/3a537a4db9e65e545
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-6197

31 Jan 2025 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 37.5

CVSS 27.8

EPSS0.04296

curl asn1 parser utf8asn1str memory release utf8 processing arbitrary code execution