CVE-2020-8231: Use After Free
A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl's multi API, and sets the CURLOPTCONNECTONLY option, might experience libcurl using the wrong connection. The highest threat from this vulnerability is to data confidentiality.
Other sources
A flaw was found in libcurl from versions 7.29.0 to and including 7.71.1. An application that performs multiple requests with libcurl's multi API and sets the CURLOPTCONNECTONLY option, might in rare circumstances experience that when subsequently using the setup connect-only transfer, libcurl will pick and use the wrong connection.
Introducing commit:
https://github.com/curl/curl/commit/c43127414d
Upstream patch:
https://curl.haxx.se/2020-8231.patch
References:
https://curl.haxx.se/docs/CVE-2020-8231.html
— Red Hat
cURL libcurl could allow a remote attacker to obtain sensitive information, caused by the improper handling of the CURLOPTCONNECTONLY option. The raw data is sent over that connection to the wrong destination. An attacker could exploit this vulnerability to obtain sensitive information.
— IBM
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-8231?
CVE-2020-8231 is a vulnerability found in libcurl versions 7.29.0 through 7.71.1.
How does CVE-2020-8231 affect applications using libcurl's multi API?
Applications that perform multiple requests using libcurl's multi API and set the CURLOPT_CONNECT_ONLY option might experience libcurl using the wrong connection.
What is the severity of CVE-2020-8231?
The severity of CVE-2020-8231 is high, with a CVSS score of 7.5.
How do I fix CVE-2020-8231?
To fix CVE-2020-8231, upgrade to libcurl version 7.72.0 or higher.
Where can I find more information about CVE-2020-8231?
You can find more information about CVE-2020-8231 at the following references: [link1], [link2], [link3].