When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer. This is due to an out of bounds read
following when gnutls_record_send() returns a number of bytes sent greater
than the number of bytes it was given to send. GnuTLS does that after a
blocked send.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Hardened Images | RedHat | curl-main-8.23.0-0.1.hum1 | * |
| Curl | Ubuntu | devel | * |
| Curl | Ubuntu | resolute | * |
| Curl | Ubuntu | stonking | * |
| Curl | Ubuntu | upstream | * |