CVE-2019-3822
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM…
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.0 | High7.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 12.9% · top 3.7% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
Affected products
- affected 7.64.0
References (15)
- GLSA-201903-03 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822 (opens in a new tab)x_refsource_CONFIRMx_transferred
- DSA-4386 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- https://curl.haxx.se/docs/CVE-2019-3822.html (opens in a new tab)x_refsource_MISCx_transferred
- https://security.netapp.com/advisory/ntap-20190315-0001/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- USN-3882-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
- 106950 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- [infra-devnull] 20190404 [GitHub] [incubator-openwhisk-runtime-ballerina] falkzoll commented on issue #15: Update to new base image jdk8u202-b08_openj9-0.12.1. (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html (opens in a new tab)x_refsource_MISCx_transferred
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html (opens in a new tab)x_refsource_MISCx_transferred
- https://security.netapp.com/advisory/ntap-20190719-0004/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://support.f5.com/csp/article/K84141449 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://support.f5.com/csp/article/K84141449?utm_source=f5support&%3Butm_medium=RSS (opens in a new tab)x_refsource_CONFIRMx_transferred
- RHSA-2019:3701 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-3822)Record last updated .