erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: October 11, 2023

1 editorial brief and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Most can relax: curl SOCKS5 Heap Overflow: Hyped, but Narrow in Practice. Software that sends libcurl 7.69.0 to 8.3.0 traffic through socks5h:// (remote-resolve) proxies to URLs or redirects an attacker can influence, especially on old 7.x builds.
  • Maven: 1 critical advisory (org.apache.zookeeper:zookeeper). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Most can relax

· Vulnerability · CVE-2023-38545, CVE-2023-38546

curl SOCKS5 Heap Overflow: Hyped, but Narrow in Practice

Pre-announced as the worst curl flaw in a long time, the bug only bites when libcurl uses a SOCKS5 proxy with remote name resolution and an attacker can supply a very long hostname; take 8.4.0 or later in normal patching, and hurry only if that proxy setup applies to you.

Must act: Software that sends libcurl 7.69.0 to 8.3.0 traffic through socks5h:// (remote-resolve) proxies to URLs or redirects an attacker can influence, especially on old 7.x builds.

Can relax: Anyone who does not use SOCKS5 proxies with hostname resolution, including the curl command-line tool at default settings, which is only vulnerable with --limit-rate below 65541 bytes per second.

  1. Check versions with `curl -V` and your language bindings (e.g. `python3 -c "import pycurl; print(pycurl.version)"`).
  2. Upgrade curl/libcurl to 8.4.0 or later, or apply your distribution's backported package.
  3. Search configs and environment for socks5h:// proxies, CURLPROXY_SOCKS5_HOSTNAME and --socks5-hostname.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>