TFTP direction confusion

Overview

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent CURLOPT_READDATA pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.

Affected

• curl >= 8.22.0 <= 8.22.0
• curl >= 8.21.0 <= 8.21.0
• curl >= 8.20.0 <= 8.20.0
• curl >= 8.19.0 <= 8.19.0
• curl >= 8.18.0 <= 8.18.0
• curl >= 8.17.0 <= 8.17.0
• curl >= 8.16.0 <= 8.16.0
• curl >= 8.15.0 <= 8.15.0
• curl >= 8.14.1 <= 8.14.1
• curl >= 8.14.0 <= 8.14.0
• curl >= 8.13.0 <= 8.13.0
• curl >= 8.12.1 <= 8.12.1
• curl >= 8.12.0 <= 8.12.0
• curl >= 8.11.1 <= 8.11.1
• curl >= 8.11.0 <= 8.11.0
• curl >= 8.10.1 <= 8.10.1
• curl >= 8.10.0 <= 8.10.0
• curl >= 8.9.1 <= 8.9.1
• curl >= 8.9.0 <= 8.9.0
• curl >= 8.8.0 <= 8.8.0
• curl >= 8.7.1 <= 8.7.1
• curl >= 8.7.0 <= 8.7.0
• curl >= 8.6.0 <= 8.6.0
• curl >= 8.5.0 <= 8.5.0
• curl >= 8.4.0 <= 8.4.0
• curl >= 8.3.0 <= 8.3.0
• curl >= 8.2.1 <= 8.2.1
• curl >= 8.2.0 <= 8.2.0
• curl >= 8.1.2 <= 8.1.2
• curl >= 8.1.1 <= 8.1.1
• curl >= 8.1.0 <= 8.1.0
• curl >= 8.0.1 <= 8.0.1
• curl >= 8.0.0 <= 8.0.0
• curl >= 7.88.1 <= 7.88.1
• curl >= 7.88.0 <= 7.88.0
• curl >= 7.87.0 <= 7.87.0
• curl >= 7.86.0 <= 7.86.0
• curl >= 7.85.0 <= 7.85.0
• curl >= 7.84.0 <= 7.84.0
• curl >= 7.83.1 <= 7.83.1
• curl >= 7.83.0 <= 7.83.0
• curl >= 7.82.0 <= 7.82.0
• curl >= 7.81.0 <= 7.81.0
• curl >= 7.80.0 <= 7.80.0
• curl >= 7.79.1 <= 7.79.1
• curl >= 7.79.0 <= 7.79.0
• curl >= 7.78.0 <= 7.78.0
• curl >= 7.77.0 <= 7.77.0
• curl >= 7.76.1 <= 7.76.1
• curl >= 7.76.0 <= 7.76.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.