CVE-2018-1000122 — CRITICAL (9.1)

Q: What is CVE-2018-1000122?

CVE-2018-1000122 is a vulnerability with a CVSS score of 9.1 (CRITICAL). A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage

Q: How severe is CVE-2018-1000122?

CVE-2018-1000122 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2018-1000122?

Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Canonical Ubuntu Linux, Haxx Curl, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server.

Vulnerability Description

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage

CVSS Score

9.1

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Debian	Debian Linux	7.0
Canonical	Ubuntu Linux	12.04
Haxx	Curl	>= 7.20.0, <= 7.58.0
Redhat	Enterprise Linux Desktop	7.0
Redhat	Enterprise Linux Server	7.0
Redhat	Enterprise Linux Workstation	7.0
Oracle	Communications Webrtc Session Controller	< 7.2
Oracle	Enterprise Manager Ops Center	12.2.2
Oracle	Peoplesoft Enterprise Peopletools	8.55

Related Weaknesses (CWE)

CWE-125

References

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlPatch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch
http://www.securityfocus.com/bid/103436Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040530Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3157Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3558Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1543
https://access.redhat.com/errata/RHSA-2020:0544
https://access.redhat.com/errata/RHSA-2020:0594
https://curl.haxx.se/docs/adv_2018-b047.htmlVendor Advisory
https://lists.debian.org/debian-lts-announce/2018/03/msg00012.htmlMailing ListThird Party Advisory
https://usn.ubuntu.com/3598-1/Third Party Advisory
https://usn.ubuntu.com/3598-2/Third Party Advisory
https://www.debian.org/security/2018/dsa-4136Third Party Advisory

FAQ

What is CVE-2018-1000122?

CVE-2018-1000122 is a vulnerability with a CVSS score of 9.1 (CRITICAL). A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage

How severe is CVE-2018-1000122?

CVE-2018-1000122 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2018-1000122?

Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Canonical Ubuntu Linux, Haxx Curl, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server.