cURL vulnerability CVE-2024-2398 - Is DLP vulnerable?

Products

• Data Loss Prevention Enterprise Suite

Issue/Introduction

Checking DLP systems (Servers and Agents) against CVE-2024-2398

Environment

DLP 15.8

DLP 16.x

Cause

CVE-2024-2398:

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application. - Is DLP vulnerable?

Resolution

DLP servers are not vulnerable

DLP agents are not vulnerable

 

 

Additional Information

CVE-2024-2398 is not applicable to DLP Agent or Servers. Primary reason being that DLP does not set the relevant options in Libcurl that are required for the server to PUSH headers. Currently, DLP products that use Libcurl do not allow the servers to do HTTP/2 server push.