Debian Security Bug TrackerDEBIANCVE:CVE-2024-2398CVE-2024-2398
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
6.5 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
10.5%
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | curl | < 7.88.1-10+deb12u6 | curl_7.88.1-10+deb12u6_all.deb |
| Debian | 11 | all | curl | < 7.74.0-1.3+deb11u12 | curl_7.74.0-1.3+deb11u12_all.deb |
| Debian | 999 | all | curl | < 8.7.1-1 | curl_8.7.1-1_all.deb |
| Debian | 13 | all | curl | < 8.7.1-1 | curl_8.7.1-1_all.deb |
Related
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
6.5 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
10.5%