CVEvulnerability
CVE-2024-2398
8.6 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-03-27
- Last modified
- 2026-10-15
- Assigner
- 2499f714-1537-4658-8207-48ae4bb9eae9
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
- Weaknesses
- CWE-772
Description
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
Affected configurations
• haxx curl (>= 7.44.0 < 8.7.0)
• apple macos (< 12.7.6)
• apple macos (>= 13.0 < 13.6.8)
• apple macos (>= 14.0 < 14.6)
• fedoraproject fedora 39
• fedoraproject fedora 40
• netapp active iq unified manager
• netapp ontap select deploy administration utility
• netapp brocade fabric operating system
• netapp bootstrap os
• netapp h300s firmware
• netapp h410s firmware
• netapp h500s firmware
• netapp h610c firmware
• netapp h610s firmware
• netapp h615c firmware
• netapp h700s firmware
Related
Weakness · CWE (1)
- CWE-772 Missing Release of Resource after Effective Lifetime weakness
References
- http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/03/27/3 Mailing List, Third Party Advisory
- https://curl.se/docs/CVE-2024-2398.html Vendor Advisory
- https://curl.se/docs/CVE-2024-2398.json Vendor Advisory
- https://hackerone.com/reports/2402845 Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/ Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240503-0009/ Third Party Advisory
- https://support.apple.com/kb/HT214118 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214119 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214120 Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/03/27/3 Mailing List, Third Party Advisory
- https://curl.se/docs/CVE-2024-2398.html Vendor Advisory
- https://curl.se/docs/CVE-2024-2398.json Vendor Advisory
- https://hackerone.com/reports/2402845 Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/ Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240503-0009/ Third Party Advisory
- https://support.apple.com/kb/HT214118 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214119 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214120 Release Notes, Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-331112.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-417159.html cert-portal.siemens.com