curl supports the -t
command line option, known as CURLOPT_TELNETOPTIONS
in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending NEW_ENV
variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
[
{
"vendor": "n/a",
"product": "https://github.com/curl/curl",
"versions": [
{
"version": "curl 7.7 to and including 7.77.0",
"status": "affected"
}
]
}
]
seclists.org/fulldisclosure/2021/Sep/39
seclists.org/fulldisclosure/2021/Sep/40
cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
hackerone.com/reports/1223882
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
security.gentoo.org/glsa/202212-01
security.netapp.com/advisory/ntap-20210902-0003/
support.apple.com/kb/HT212804
support.apple.com/kb/HT212805
www.oracle.com/security-alerts/cpujan2022.html
www.oracle.com/security-alerts/cpuoct2021.html