DeutschShown in its original language — a full translation is planned for a future version.
cURL: Mehrere Schwachstellen
view advisory published 2022-10-25
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder weitere, nicht näher spezifizierte Angriffe durchzuführen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-35260US | medium6.5 | — | ||
curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the en… | ||||
| CVE-2022-32221US | critical9.8 | — | ||
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been s… | ||||
| CVE-2022-42915US | high8.1 | — | ||
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNEC… | ||||
| CVE-2022-42916US | high7.5OT elevated | — | ||
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using a… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2022:8840 vom 2022-12-08external
- Red Hat Security Advisory RHSA-2022:8841 vom 2022-12-08external
- Red Hat Security Advisory RHSA-2023:0333 vom 2023-01-23external
- Red Hat Security Advisory RHSA-2023:4139 vom 2023-07-18external
- IBM AIX Advisory vom 2023-05-26external
- Amazon Linux Security Advisory ALAS-2022-1882 vom 2022-12-07external
- Amazon Linux Security Advisory ALAS-2022-246 vom 2022-12-09external
- Curl Security Advisory vom 2022-10-25external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan