snowflakedb/libsnowflakeclient

curlcurl-7_68_0: 20 vulnerabilities (highest severity is: 9.8)

Closed this issue · 0 comments

mend-for-github-com commented
Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/connect.c
/deps/curl-7.68.0/lib/connect.c
/deps/curl-7.68.0/lib/multi.c
/deps/curl-7.68.0/lib/easy.c

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2022-32207 High 9.8 curlcurl-7_68_0 Direct curl-7_84_0 ❌
CVE-2022-22576 High 8.1 curlcurl-7_68_0 Direct curl-7_83_0 ❌
CVE-2020-8231 High 7.5 curlcurl-7_68_0 Direct curl-7_72_0 ❌
CVE-2020-8285 High 7.5 curlcurl-7_68_0 Direct 7.74.0 ❌
CVE-2021-22926 High 7.5 curlcurl-7_68_0 Direct curl-7_78_0 ❌
CVE-2022-27782 High 7.5 curlcurl-7_68_0 Direct curl-7_83_1 ❌
CVE-2022-27775 High 7.5 curlcurl-7_68_0 Direct curl-7_83_0 ❌
CVE-2022-27781 High 7.5 curlcurl-7_68_0 Direct curl-7_83_1 ❌
CVE-2021-22922 Medium 6.5 curlcurl-7_68_0 Direct curl-7_78_0 ❌
CVE-2022-32206 Medium 6.5 curlcurl-7_68_0 Direct curl-7_84_0 ❌
CVE-2022-27776 Medium 6.5 curlcurl-7_68_0 Direct curl-7_83_0 ❌
CVE-2022-32208 Medium 5.9 curlcurl-7_68_0 Direct curl-7_84_0 ❌
CVE-2022-27774 Medium 5.7 curlcurl-7_68_0 Direct curl-7_83_0 ❌
CVE-2021-22876 Medium 5.3 curlcurl-7_68_0 Direct curl-7_76_0 ❌
CVE-2021-22923 Medium 5.3 curlcurl-7_68_0 Direct curl-7_78_0 ❌
CVE-2021-22925 Medium 5.3 curlcurl-7_68_0 Direct curl-7_78_0 ❌
CVE-2022-32205 Medium 4.3 curlcurl-7_68_0 Direct curl-7_71_0 ❌
CVE-2020-8284 Low 3.7 curlcurl-7_68_0 Direct 7.74.0 ❌
CVE-2021-22924 Low 3.7 curlcurl-7_68_0 Direct curl-7_78_0 ❌
CVE-2021-22890 Low 3.7 curlcurl-7_68_0 Direct curl-7_76_0 ❌

Details

CVE-2022-32207

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/cookie.c
/deps/curl-7.68.0/lib/cookie.c

Vulnerability Details

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated file accessible to more users than intended.

Publish Date: 2022-07-07

URL: CVE-2022-32207

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-06-02

Fix Resolution: curl-7_84_0

CVE-2022-22576

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (1)

/deps/curl-7.68.0/lib/strcase.c

Vulnerability Details

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

Publish Date: 2022-05-26

URL: CVE-2022-22576

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2022-22576.html

Release Date: 2022-01-05

Fix Resolution: curl-7_83_0

CVE-2020-8231

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/connect.c
/deps/curl-7.68.0/lib/connect.c
/deps/curl-7.68.0/lib/multi.c
/deps/curl-7.68.0/lib/easy.c

Vulnerability Details

Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

Publish Date: 2020-12-14

URL: CVE-2020-8231

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-14

Fix Resolution: curl-7_72_0

CVE-2020-8285

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/ftp.c
/deps/curl-7.68.0/lib/ftp.c

Vulnerability Details

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

Publish Date: 2020-12-14

URL: CVE-2020-8285

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2020-8285.html

Release Date: 2020-12-14

Fix Resolution: 7.74.0

CVE-2021-22926

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/vtls/sectransp.c
/deps/curl-7.68.0/lib/vtls/sectransp.c

Vulnerability Details

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPT_SSLCERT option (--cert with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like /tmp), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

Publish Date: 2021-08-05

URL: CVE-2021-22926

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22926.html

Release Date: 2021-08-05

Fix Resolution: curl-7_78_0

CVE-2022-27782

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/vtls/vtls.c
/deps/curl-7.68.0/lib/vtls/mbedtls.c
/deps/curl-7.68.0/lib/vtls/gtls.c
/deps/curl-7.68.0/lib/vtls/nss.c

Vulnerability Details

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Publish Date: 2022-06-02

URL: CVE-2022-27782

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2022-27782.html

Release Date: 2022-06-02

Fix Resolution: curl-7_83_1

CVE-2022-27775

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/conncache.c
/deps/curl-7.68.0/lib/conncache.c

Vulnerability Details

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.

Publish Date: 2022-06-02

URL: CVE-2022-27775

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/1546268

Release Date: 2022-06-02

Fix Resolution: curl-7_83_0

CVE-2022-27781

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/vtls/nss.c
/deps/curl-7.68.0/lib/vtls/nss.c

Vulnerability Details

libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Publish Date: 2022-06-02

URL: CVE-2022-27781

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2022-27781.html

Release Date: 2022-06-02

Fix Resolution: curl-7_83_1

CVE-2021-22922

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (4)

/deps/curl-7.68.0/src/tool_operate.c
/deps/curl-7.68.0/src/tool_getparam.c
/deps/curl-7.68.0/src/tool_cfgable.h
/deps/curl-7.68.0/src/tool_sdecls.h

Vulnerability Details

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

Publish Date: 2021-08-05

URL: CVE-2021-22922

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22922.html

Release Date: 2021-08-05

Fix Resolution: curl-7_78_0

CVE-2022-32206

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (1)

/deps/curl-7.68.0/lib/content_encoding.c

Vulnerability Details

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

Publish Date: 2022-07-07

URL: CVE-2022-32206

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-06-02

Fix Resolution: curl-7_84_0

CVE-2022-27776

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/http.c
/deps/curl-7.68.0/lib/http.c

Vulnerability Details

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

Publish Date: 2022-06-02

URL: CVE-2022-27776

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/1547048

Release Date: 2022-06-02

Fix Resolution: curl-7_83_0

CVE-2022-32208

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/krb5.c
/deps/curl-7.68.0/lib/krb5.c

Vulnerability Details

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Publish Date: 2022-07-07

URL: CVE-2022-32208

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2022-32208

Release Date: 2022-06-02

Fix Resolution: curl-7_84_0

CVE-2022-27774

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/vtls/gtls.c
/deps/curl-7.68.0/lib/vtls/gtls.c

Vulnerability Details

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Publish Date: 2022-06-02

URL: CVE-2022-27774

CVSS 3 Score Details (5.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/1543773

Release Date: 2022-03-24

Fix Resolution: curl-7_83_0

CVE-2021-22876

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/transfer.c
/deps/curl-7.68.0/lib/transfer.c

Vulnerability Details

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Publish Date: 2021-04-01

URL: CVE-2021-22876

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22876.html

Release Date: 2021-04-01

Fix Resolution: curl-7_76_0

CVE-2021-22923

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (4)

/deps/curl-7.68.0/src/tool_operate.c
/deps/curl-7.68.0/src/tool_getparam.c
/deps/curl-7.68.0/src/tool_cfgable.h
/deps/curl-7.68.0/src/tool_sdecls.h

Vulnerability Details

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

Publish Date: 2021-08-05

URL: CVE-2021-22923

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22923.html

Release Date: 2021-08-05

Fix Resolution: curl-7_78_0

CVE-2021-22925

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/telnet.c
/deps/curl-7.68.0/lib/telnet.c

Vulnerability Details

curl supports the -t command line option, known as CURLOPT_TELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending NEW_ENV variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

Publish Date: 2021-08-05

URL: CVE-2021-22925

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22925.html

Release Date: 2021-08-05

Fix Resolution: curl-7_78_0

CVE-2022-32205

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/http.c
/deps/curl-7.68.0/lib/http_proxy.c
/deps/curl-7.68.0/lib/http_proxy.c
/deps/curl-7.68.0/lib/http.c

Vulnerability Details

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on foo.example.com can set cookies that also would match for bar.example.com, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.

Publish Date: 2022-07-07

URL: CVE-2022-32205

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-07-07

Fix Resolution: curl-7_71_0

CVE-2020-8284

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (2)

/deps/curl-7.68.0/src/tool_cfgable.c
/deps/curl-7.68.0/src/tool_cfgable.c

Vulnerability Details

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Publish Date: 2020-12-14

URL: CVE-2020-8284

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2020-8284.html

Release Date: 2020-12-14

Fix Resolution: 7.74.0

CVE-2021-22924

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/vtls/vtls.c
/deps/curl-7.68.0/lib/vtls/nss.c
/deps/curl-7.68.0/lib/vtls/gtls.c
/deps/curl-7.68.0/lib/vtls/nss.c

Vulnerability Details

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths case insensitively,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Publish Date: 2021-08-05

URL: CVE-2021-22924

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22924.html

Release Date: 2021-08-05

Fix Resolution: curl-7_78_0

CVE-2021-22890

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/vtls/vtls.c
/deps/curl-7.68.0/lib/vtls/bearssl.c
/deps/curl-7.68.0/lib/vtls/wolfssl.c
/deps/curl-7.68.0/lib/vtls/sectransp.c

Vulnerability Details

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

Publish Date: 2021-04-01

URL: CVE-2021-22890

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22890.html

Release Date: 2021-04-01

Fix Resolution: curl-7_76_0