CVE-2019-3822
| Affected software | 11 products, listed below |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Weakness | Out-of-bounds write (CWE-787) |
| Published | 6 Feb 2019 |
| Updated | 17 Jun 2026 |
Description
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.
CWE-121
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 7 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 13% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.0 | 7.1 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H |
secalert@redhat.com | Secondary | |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2019 ↗ | CPU | 2019-Q3 | Oracle Enterprise Manager Products Suite / Networking (cURL) (12.3.3, 12.4.0) Oracle MySQL / Server: Packaging (cURL) (5.7.26 and prior, 8.0.15 and prior) Oracle Support Tools / Utilities (cURL) (19.2) |
| Oracle Critical Patch Update April 2019 ↗ | CPU | 2019-Q2 | Oracle Communications Applications / Security (curl) (3.4, 4.0) Oracle Fusion Middleware / Web Listener (curl) (12.2.1.3.0) Oracle Virtualization / Core (curl) (5.4) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications Applications | Security (curl) | 3.4, 4.0 | 3.4 · 4.0 |
| Oracle Enterprise Manager Products Suite | Networking (cURL) | 12.3.3, 12.4.0 | 12.3.3 · 12.4.0 |
| Oracle Fusion Middleware | Web Listener (curl) | 12.2.1.3.0 | 12.2.1.3.0 |
| Oracle MySQL | Server: Packaging (cURL) | 5.7.26 and prior, 8.0.15 and prior | |
| Oracle Support Tools | Utilities (cURL) | 19.2 | 19.2 |
| Oracle Virtualization | Core (curl) | 5.4 | 5.4 |
Products and versions
16 products, 23 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | canonical | ubuntu linux | generic | 14.04 · 16.04 · 18.04 · 18.10 |
| nvd | debian | debian linux | generic | 9.0 |
| nvd | haxx | libcurl | generic | ≥ 7.36.0 and ＜ 7.64.0 |
| nvd | netapp | active iq unified manager | generic | ≥ 7.3 · ≥ 9.5 |
| nvd | netapp | clustered data ontap | generic | any version |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | netapp | oncommand workflow automation | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | oracle | communications operations monitor | generic | 3.4 · 4.0 |
| nvd | oracle | enterprise manager ops center | generic | 12.3.3 · 12.4.0 |
| nvd | oracle | http server | generic | 12.2.1.3.0 |
| nvd | oracle | mysql server | generic | ≤ 5.7.26 · ≥ 5.7.27 and ≤ 8.0.15 |
| nvd | oracle | secure global desktop | generic | 5.4 |
| nvd | oracle | services tools bundle | generic | 19.2 |
| nvd | redhat | enterprise linux | generic | 8.0 |
| nvd | siemens | sinema remote connect client | generic | ≤ 2.0 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, MYSQL PROTOCOL, NETWORKING (CURL), MULTIPLE, CORE (CURL), WEB LISTENER (CURL), SERVER: PACKAGING (CURL), SECURITY (CURL), NO AUTH REMOTE EXPLOIT, UTILITIES (CURL) **Products:** ORACLE SUPPORT TOOLS, ORACLE VIRTUALIZATION, ORACLE HTTP SERVER, ORACLE COMMUNICATIONS OPERATIONS MONITOR, ORACLE FUSION MIDDLEWARE, ORACLE MYSQL, ORACLE SECURE GLOBAL DESKTOP, ENTERPRISE MANAGER OPS CENTER, MYSQL SERVER, ORACLE COMMUNICATIONS APPLICATIONS, SERVICES TOOLS BUNDLE, CURL, ORACLE ENTERPRISE MANAGER PRODUCTS SUITE
References
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/106950 | Third Party Advisory, VDB Entry |
| https://access.redhat.com/errata/RHSA-2019:3701 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822 | Exploit, Issue Tracking, Patch, Third Party Advisory |
| https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf | Third Party Advisory |
| https://curl.haxx.se/docs/CVE-2019-3822.html | Patch, Vendor Advisory |
| https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E | |
| https://security.gentoo.org/glsa/201903-03 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20190315-0001/ | Patch, Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20190719-0004/ | Third Party Advisory |
| https://support.f5.com/csp/article/K84141449 | Third Party Advisory |
Timeline
Timeline
| Published | 2019-02-06 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |