CVE-2023-28322: more POST-after-PUT confusion

Summary

CVE-2023-28322 - more POST-after-PUT confusion

VULNERABILITY When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback.

This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer.

The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

SOLUTION This time the logic is improved to avoid having two separate variable fields holding info about HTTP method and behavior. Now there is only one, which should make it harder to end up in such a confused middle state.

Fixed-in: https://github.com/curl/curl/commit/7815647d6582c0a4900be2e1de

TIMELINE This issue was reported to the curl project on April 19, 2023. We contacted distros @ openwall on May 9, 2023.

libcurl 8.1.0 was released on May 17 2023, coordinated with the publication of this advisory.

CREDITS Reported-by: Hiroki Kurosawa Patched-by: Daniel Stenberg

Link to full Security Advisory: https://curl.se/docs/CVE-2023-28322.html