CVE-2022-32207Critical· 9.8▾ MidnightWhen curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accide…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 1.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
7.7%
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated file accessible to more users than intended.
curl >= 7.69.0, < 7.84.0fedora = 35debian_linux = 11.0clustered_data_ontapelement_softwarehci_management_nodesolidfirebootstrap_osh300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwaremacos < 13.0universal_forwarder >= 8.2.0, < 8.2.12universal_forwarder >= 9.0.0, < 9.0.6universal_forwarder = 9.1.0Upgrade past the affected range:
curl 7.84.0macos 13.0universal_forwarder 9.0.6Connected by shared product, vendor, weakness, or advisory.
CVE-2022-32208Medium· 5.9When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly
CVE-2022-27782High· 7.5libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse i…
CVE-2021-22926High· 7.5libcurl-using applications can ask for a specific client certificate to be used in a transfer
CVE-2021-22922Medium· 6.5When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of diff…
CVE-2022-42915High· 8.1curl before 7.86.0 has a double free
CVE-2022-42916High· 7.5In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP