CVE-2022-35252Low· 3.7▾ SunlitWhen curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.4%
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
curl < 7.85.0clustered_data_ontapelement_softwarehci_management_nodesolidfirebootstrap_osh300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwaremacos >= 11.0, < 11.7.3macos >= 12.0.0, < 12.6.3debian_linux = 10.0universal_forwarder >= 8.2.0, < 8.2.12universal_forwarder >= 9.0.0, < 9.0.6universal_forwarder = 9.1.0Upgrade past the affected range:
curl 7.85.0macos 12.6.3universal_forwarder 9.0.6Connected by shared product, vendor, weakness, or advisory.
CVE-2022-42915High· 8.1curl before 7.86.0 has a double free
CVE-2022-42916High· 7.5In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP
CVE-2022-35260Medium· 6.5curl can be told to parse a `.netrc` file for credentials
CVE-2022-32221Critical· 9.8When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PU…
CVE-2022-32207Critical· 9.8When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accide…
CVE-2022-32208Medium· 5.9When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly