Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error.
References
| Link | Resource |
|---|---|
| https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-everything-that-is-wrong-with-cves/ | Issue Tracking |
| https://github.com/curl/curl/pull/4166 | Patch |
Configurations
History
07 Nov 2023, 03:19
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error. |
05 Sep 2023, 14:34
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 3.3 |
| References | (MISC) https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-everything-that-is-wrong-with-cves/ - Issue Tracking |
28 Aug 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | ** DISPUTED ** Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error. |
25 Aug 2023, 02:47
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:haxx:curl:7.65.2:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Haxx
Haxx curl |
|
| CWE | CWE-190 | |
| References | (MISC) https://github.com/curl/curl/pull/4166 - Patch |
22 Aug 2023, 20:10
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-22 19:16
Updated : 2024-08-04 15:15
NVD link : CVE-2020-19909
Mitre link : CVE-2020-19909
CVE.ORG link : CVE-2020-19909
JSON object : View
Products Affected
haxx
- curl
CWE
CWE-190
Integer Overflow or Wraparound