QwikSec

Security Database

CVE

CWE

Training

CVE-2019-5443

Published: Jul 2, 2019

Modified: Aug 4, 2024

PUBLISHED

Description

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.

Vendor	Product	Versions
n/a	curl	affected `<= 7.65.1`

Weaknesses (CWE)

References

[oss-security] 20190624 curl: Windows OpenSSL engine code injection

mailing-list

x_refsource_MLIST

vdb-entry

x_refsource_BID

https://www.oracle.com/security-alerts/cpuapr2020.html

x_refsource_MISC

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

x_refsource_MISC

https://www.oracle.com/security-alerts/cpuoct2020.html

x_refsource_MISC

https://curl.haxx.se/docs/CVE-2019-5443.html

x_refsource_MISC

https://security.netapp.com/advisory/ntap-20191017-0002/

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.