Lucene search

K
osvGoogleOSV:USN-6718-3
HistoryApr 29, 2024 - 11:34 a.m.

curl vulnerabilities

2024-04-2911:34:42
Google
osv.dev
2
usn-6718-1
curl
ubuntu 24.04 lts
memory handling
denial of service
http/2
protocol misuse

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.4%

USN-6718-1 fixed vulnerabilities in curl. This update provides the
corresponding updates for Ubuntu 24.04 LTS.

Original advisory details:

Dan Fandrich discovered that curl would incorrectly use the default set of
protocols when a parameter option disabled all protocols without adding
any, contrary to expectations. This issue only affected Ubuntu 23.10.
(CVE-2024-2004)

It was discovered that curl incorrectly handled memory when limiting the
amount of headers when HTTP/2 server push is allowed. A remote attacker
could possibly use this issue to cause curl to consume resources, leading
to a denial of service. (CVE-2024-2398)