Skip to content

[Bug Report]: 发现与CVE-2021-22901类似的同源漏洞 #2015

Open
@Crispy-fried-chicken

Description

@Crispy-fried-chicken

Contact Details

[email protected]

What happened?

我发现您的项目中components/curl/lib/multi.c文件中的detach_connnection函数可能存在UAF漏洞,相关触发逻辑类似CVE-2021-22901, 具体参考链接如下:

CVE-2021-22901:
NVD说明链接:
https://nvd.nist.gov/vuln/detail/CVE-2021-22901
commit修复链接:
curl/curl@7f4a9a9

考虑到其可能存在的潜在风险,我愿意配合您以负责任的方式及时核实、解决和报告发现的漏洞。 如果您需要任何进一步的信息或帮助,请随时与我联系。如果需要,我也可以提交PR帮助您修复。 谢谢您,期待尽快收到您的回复!

Version

master (Default)

What soultions are you seeing the problem on?

No response

Relevant log output

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions