Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug Report]: Patch for CVE-2021-22901 in reused component curl #5

Open
ltcdCai opened this issue Jul 22, 2024 · 0 comments
Open

[Bug Report]: Patch for CVE-2021-22901 in reused component curl #5

ltcdCai opened this issue Jul 22, 2024 · 0 comments

Comments

@ltcdCai
Copy link

ltcdCai commented Jul 22, 2024

Contact Details
weitingcai2020@gmail.com

What happened?
我通过使用V1SCAN(一个扫描存在于复用代码中1-Day漏洞的工具),发现您的项目中Openharmonyv1.0/third_party/curl/lib文件夹下的multi.c文件可能存在漏洞, 具体参考链接如下:

CVE-2021-22901 in multi.c:
相关触发逻辑类似GHSA-vjwf-ghhc-2p8q
NVD说明链接:
https://nvd.nist.gov/vuln/detail/CVE-2021-22901
commit修复链接:
curl/curl@7f4a9a9

修复方法:
replace the lines at 864-865:

if(conn) 
    Curl_llist_remove(&conn->easyq, &data->conn_queue, NULL);  

to the following code:

if(conn) {
    Curl_llist_remove(&conn->easyq, &data->conn_queue, NULL);
    Curl_ssl_detach_conn(data, conn);
  }

考虑到其可能存在的潜在风险,我愿意配合您以负责任的方式及时核实、解决和报告发现的漏洞。 如果您需要任何进一步的信息或帮助,请随时与我联系。如果需要,我也可以提交PR帮助您修复。 谢谢您,期待尽快收到您的回复!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
1 participant