DeutschShown in its original language — a full translation is planned for a future version.
cURL: Mehrere Schwachstellen
view advisory published 2022-06-26
Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitseinstellungen zu umgehen und Daten offenzulegen oder zu manipulieren.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-32208US | medium5.9 | — | ||
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed… | ||||
| CVE-2022-32207US | critical9.8OT elevated | — | ||
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final t… | ||||
| CVE-2022-32206US | medium6.5 | — | ||
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number o… | ||||
| CVE-2022-32205US | medium4.3 | — | ||
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookie… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2022-6157 vom 2022-08-25external
- Oracle Linux Security Advisory ELSA-2022-6159 vom 2022-08-25external
- Red Hat Security Advisory RHSA-2022:6157 vom 2022-08-24external
- Red Hat Security Advisory RHSA-2022:6159 vom 2022-08-25external
- Red Hat Security Advisory RHSA-2022:6182 vom 2022-09-06external
- Red Hat Security Advisory RHSA-2022:6183 vom 2022-09-06external
- Red Hat Security Advisory RHSA-2022:6344 vom 2022-09-07external
- Red Hat Security Advisory RHSA-2022:7055 vom 2022-10-19external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan