A curl nev\u0171 h\u00e1l\u00f3zati adatok k\u00fcld\u00e9s\u00e9re \u00e9s fogad\u00e1s\u00e1ra szolg\u00e1l\u00f3 seg\u00e9dprogramban \u00e9s a p\u00e1rhuzamosan fejl\u0151d\u0151 libcurl k\u00f6nyvt\u00e1rban egy sebezhet\u0151s\u00e9get (CVE-2023-38545) fedeztek fel, amely puffert\u00falcsordul\u00e1st okozhat, \u00e9s potenci\u00e1lisan lehet\u0151v\u00e9 teheti a t\u00e1mad\u00f3 sz\u00e1m\u00e1ra, hogy k\u00f3dot hajtson v\u00e9gre a kliens oldalon, ha a curl seg\u00e9dprogramon vagy a libcurl-t haszn\u00e1l\u00f3 alkalmaz\u00e1son kereszt\u00fcl egy, a t\u00e1mad\u00f3 \u00e1ltal ir\u00e1ny\u00edtott HTTPS-szerverhez fordul. A probl\u00e9ma csak akkor jelentkezik, ha a curl a SOCKS5 proxy-n kereszt\u00fcl t\u00f6rt\u00e9n\u0151 hozz\u00e1f\u00e9r\u00e9st haszn\u00e1l. K\u00f6zvetlen h\u00edv\u00e1s eset\u00e9n, proxy n\u00e9lk\u00fcl a sebezhet\u0151s\u00e9g nem jelentkezik. A probl\u00e9m\u00e1t a curl 8.4.0 verzi\u00f3j\u00e1ban orvosolt\u00e1k. A hib\u00e1t felfedez\u0151 biztons\u00e1gi kutat\u00f3 4660 doll\u00e1r jutalmat kapott az Internet Bug Bounty program keretein bel\u00fcl a Hackerone-on. <\/p>\n
A sebezhet\u0151s\u00e9get a hosztn\u00e9v felold\u00e1s\u00e1val kapcsolatos k\u00f3dbeli hiba okozza, miel\u0151tt a SOCKS5 proxyhoz fordulna. Amikor a hosztn\u00e9v hossza legfeljebb 256 karakter, a curl azonnal \u00e1tadja a nevet a SOCKS5 proxy sz\u00e1m\u00e1ra a felold\u00e1shoz, ha a n\u00e9v hosszabb a 255 karakter hossz\u00fas\u00e1gn\u00e1l, akkor a helyi felold\u00f3ra v\u00e1lt \u00e9s a SOCKS5 sz\u00e1m\u00e1ra m\u00e1r meghat\u00e1rozott c\u00edmet tov\u00e1bb\u00edt. A k\u00f3d hib\u00e1ja miatt a helyi felold\u00e1s sz\u00fcks\u00e9gess\u00e9g\u00e9t jelz\u0151 z\u00e1szl\u00f3 a SOCKS5 proxy-n kereszt\u00fcli lass\u00fa kapcsolat-egyeztet\u00e9s sor\u00e1n nem a megfelel\u0151 \u00e9rt\u00e9kre \u00e1ll\u00edthat\u00f3, ami hossz\u00fa hosztn\u00e9v bufert\u00fall\u00e9p\u00e9s\u00e9t okozza. IP address<\/a> vagy nev\u00e9nek hossza nem haladhatja meg a 255 karaktert. <\/p>\n A web owner that accesses curl through a SOCKS5 proxy can initiate a client-side buffer overflow by returning a redirect response code (HTTP 30x) and setting the header «Location:» with a hostname URL whose size is between 16 and 64 KB (the 16 KB value is due to the minimum size required for overflowing the allocated buffer, while the 65 KB value is related to the maximum allowed length of a hostname in a URL). If redirection is permitted in libcurl settings and the SOCKS5 proxy in use is sufficiently slow, the long hostname will be written into a small buffer, which is predetermined to be smaller. <\/p>\n The vulnerability primarily affects applications based on libcurl and manifests in the curl utility only when using the «—limit-rate» option with a value less than 65541 — by default, libcurl allocates a 16 KB buffer, while the curl utility allocates 100 KB, but this size changes depending on the value of the «—limit-rate» parameter. <\/p>\n Daniel Stenberg, a projekt szerz\u0151je, eml\u00edtette, hogy a sebezhet\u0151s\u00e9g 1315 napon kereszt\u00fcl \u00e9szrev\u00e9tlen maradt. Azt is megjegyezt\u00e9k, hogy a curl \u00e1ltal kor\u00e1bban felfedezett sebezhet\u0151s\u00e9gek 41%-\u00e1t val\u00f3sz\u00edn\u0171leg el lehetett volna ker\u00fclni, ha a curl olyan nyelven \u00edr\u00f3dott volna, amely biztons\u00e1gos mem\u00f3riahaszn\u00e1latot biztos\u00edt, de a curl m\u00e1s nyelvre val\u00f3 \u00e1t\u00edr\u00e1s\u00e1t a k\u00f6zelj\u00f6v\u0151ben nem tervezik. A k\u00f3dalap biztons\u00e1g\u00e1nak n\u00f6vel\u00e9se \u00e9rdek\u00e9ben javasolt a k\u00f3d tesztel\u00e9s\u00e9re szolg\u00e1l\u00f3 eszk\u00f6z\u00f6k kib\u0151v\u00edt\u00e9se \u00e9s akt\u00edvan haszn\u00e1lni a mem\u00f3riahaszn\u00e1lat szempontj\u00e1b\u00f3l biztons\u00e1gos nyelveken \u00edrt f\u00fcgg\u0151s\u00e9geket. A curl egyes r\u00e9szeinek fokozatos cser\u00e9je is ter\u00edt\u00e9ken van, biztons\u00e1gos nyelveken, p\u00e9ld\u00e1ul a Rust nyelven megval\u00f3s\u00edtott k\u00eds\u00e9rleti HTTP-backend, a Hyper haszn\u00e1lat\u00e1val. \u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libcurl \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-38545), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u044b curl \u0438\u043b\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0433\u043e libcurl, \u043a HTTPS-\u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432 curl […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110745","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Puffer t\u00falcsordul\u00e1s a curl-ben \u00e9s libcurl-ben, amely SOCKS5 proxy-n kereszt\u00fcli h\u00edv\u00e1sok sor\u00e1n jelentkezik | ProHoster","description":"A curl adatk\u00fcld\u00e9sre \u00e9s -fogad\u00e1sra szolg\u00e1l\u00f3 seg\u00e9dprogramj\u00e1ban \u00e9s a p\u00e1rhuzamosan fejl\u0151d\u0151 libcurl k\u00f6nyvt\u00e1rban sebezhet\u0151s\u00e9get (CVE-2023-38545) tal\u00e1ltak, amely puffer t\u00falcsordul\u00e1shoz \u00e9s potenci\u00e1lisan k\u00f3dv\u00e9grehajt\u00e1shoz vezethet.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/perepolnenie-bufera-v-curl-i-libcurl-proyavlyayushheesya-pri-obrashhenii-cherez-socks5-proksi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 curl \u0438 libcurl, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 SOCKS5-\u043f\u0440\u043e\u043a\u0441\u0438 | ProHoster","og:description":"\u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libcurl \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-38545), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/perepolnenie-bufera-v-curl-i-libcurl-proyavlyayushheesya-pri-obrashhenii-cherez-socks5-proksi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-11T19:10:17+00:00","article:modified_time":"2023-10-11T19:10:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110745","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:24:09","updated":"2026-02-08 20:24:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/110745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=110745"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/110745\/revisions"}],"predecessor-version":[{"id":157908,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/110745\/revisions\/157908"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=110745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=110745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=110745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"