CVE-2020-19909

Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error.

References

Affected packages

Git / github.com/curl/curl

Affected ranges

Type

GIT

Repo

https://github.com/curl/curl

Events

Introduced

72c2cac8f0ac3a89c21d00b6c6e36fe6c6a8e62b

Last affected

72c2cac8f0ac3a89c21d00b6c6e36fe6c6a8e62b

Database specific

{
    "cpe": "cpe:2.3:a:haxx:curl:7.65.2:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.65.2"
        },
        {
            "last_affected": "7.65.2"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

7.*

7.65.2

Other

curl-7_65_2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-19909.json"