CVE-2022-27781

CERTINFO never-endingbusy-loop

Project curl Security Advisory, May 11 2022 -Permalink

VULNERABILITY

libcurl provides theCURLOPT_CERTINFO option to allowapplications to request details to be returned about a TLS server'scertificate chain.

Due to an erroneous function, a malicious server could make libcurlbuilt with NSS get stuck in a never-ending busy-loop when trying toretrieve that information.

INFO

This flaw was introduced in in curl7.34.0 when libcurl added supportforCURLOPT_CERTINFO using NSS.

This feature is not accessible from the command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assignedthe name CVE-2022-27781 to this issue.

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

Severity: Low

AFFECTED VERSIONS

• Affected versions: curl7.34.0 to and including7.83.0
• Not affected versions: curl <7.34.0 and curl >=7.83.1
• Introduced-in:https://github.com/curl/curl/commit/f6c335d63f

libcurl is used by many applications, but not always advertised assuch!

SOLUTION

• Fixed-in:https://github.com/curl/curl/commit/5c7da89d404bf59

RECOMMENDATIONS

A - Upgrade curl to version7.83.1

B - Apply the patch to your local version

C - Do not use theCURLOPT_CERTINFO option

TIMELINE

This issue was reported to the curl project on April 30, 2022. Wecontacted distros@openwall on May 5.

libcurl7.83.1 was released on May 11 2022, coordinated with thepublication of this advisory.

CREDITS

• Reported-by: Florian Kohnhäuser
• Patched-by: Daniel Stenberg

Thanks a lot!