IBM Event Streams update for cURL

1) Expected behavior violation

EUVDB-ID: #VU76238

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28322

CWE-ID: CWE-440 - Expected Behavior Violation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a logic error when sending HTTP POST and PUT requests using the same handle. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. As a result, the application can misbehave and either send off the wrong data or use memory after free or similar in the second transfer.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Event Streams: 11.0.0 - 11.3.1

CPE2.3

• cpe:2.3:a:ibm_corporation:event_streams:11.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:event_streams:11.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:event_streams:11.0.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7175757

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.