DeutschShown in its original language — a full translation is planned for a future version.
cURL: Mehrere Schwachstellen
view advisory published 2022-05-10
Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen, Dateien zu löschen oder einen Denial of Service zu verursachen.
01
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-30115US | medium4.3OT elevated | — | ||
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be… | ||||
| CVE-2022-27782US | high7.5 | — | ||
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connection… | ||||
| CVE-2022-27781US | high7.5 | — | ||
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious s… | ||||
| CVE-2022-27780US | high7.5 | — | ||
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it i… | ||||
| CVE-2022-27779US | medium5.3OT elevated | — | ||
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie e… | ||||
| CVE-2022-27778US | high8.1 | — | ||
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2022-5245 vom 2022-07-01external
- Oracle Linux Security Advisory ELSA-2022-5313 vom 2022-07-01external
- Red Hat Security Advisory RHSA-2022:5245 vom 2022-07-01external
- Red Hat Security Advisory RHSA-2022:5313 vom 2022-07-01external
- Amazon Linux Security Advisory ALAS-2022-1808 vom 2022-07-15external
- Amazon Linux Security Advisory ALAS-2023-1924 vom 2023-02-06external
- Amazon Linux Security Advisory ALAS-2022-065 vom 2022-05-20external
- Amazon Linux Security Advisory ALAS-2022-1646 vom 2022-12-10external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan