Description
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- Debian / debian_linux10.0 – 10.0
- Debian / debian_linux11.0 – 11.0
- haxx / curl7.83.1
- NetApp / Clustered Data ONTAP
- NetApp / h300s_firmware
- NetApp / h410s_firmware
- NetApp / h500s_firmware
- NetApp / h700s_firmware
- NetApp / hci_bootstrap_os
- NetApp / hci_compute_node
- NetApp / solidfire,_enterprise_sds_&_hci_storage_node
- NetApp / solidfire_&_hci_management_node
- Splunk / Universal Forwarder8.2.0 – 8.2.12
- Splunk / Universal Forwarder9.1.0 – 9.1.0
Updated 44m ago · 8 sources