CVE-2020-19909: Integer Overflow
** DISPUTED ** Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-19909?
CVE-2020-19909 refers to an integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay.
What is the severity of CVE-2020-19909?
CVE-2020-19909 has a severity value of 3.3, which is considered low.
How does CVE-2020-19909 impact the curl user?
Many parties report that CVE-2020-19909 has no direct security impact on the curl user.
Can CVE-2020-19909 cause a denial of service to associated systems or networks?
In theory, CVE-2020-19909 may cause a denial of service to associated systems or networks.
How can I fix CVE-2020-19909?
To fix CVE-2020-19909, update to a version of curl that does not have the vulnerability.