CVSS: 5.3EPSS: 0%CPEs: 18EXPL: 1CVE-2022-27779
https://notcve.org/view.php?id=CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain. libcurl permite erróneamente que se establezcan cookies para Dominios de Alto Nivel (TLDs) si el nombre de host es proporcionado con un punto al final. curl puede recibir y enviar cookies. "cookie engine" de curl puede construirse con o sin conocimiento de la [Lista de Sufijos Públicos] (https://publicsuffix.org/). Si no es proporcionado soporte de PSL, se presenta una comprobación más rudimentaria para al menos evitar que sean establecidas cookies en los TLD. • https://hackerone.com/reports/1553301 https://security.gentoo.org/glsa/202212-01 https://security.netapp.com/advisory/ntap-20220609-0009 • CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 1CVE-2022-30115
https://notcve.org/view.php?id=CVE-2022-30115
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL. usando su soporte HSTS, curl puede ser instruido para usar HTTPS directamente en lugar de usar un paso no seguro de texto sin cifrar HTTP incluso cuando HTTP es proporcionado en la URL. Este mecanismo podría ser omitido si el nombre de host en la URL dada usara un endpoint mientras no es usado uno cuando es construida la caché HSTS. O al revés, si el endpoint estuviera en la caché HSTS y *no* es usado el punto al final en la URL • http://www.openwall.com/lists/oss-security/2022/10/26/4 http://www.openwall.com/lists/oss-security/2022/12/21/1 https://hackerone.com/reports/1557449 https://security.gentoo.org/glsa/202212-01 https://security.netapp.com/advisory/ntap-20220609-0009 • CWE-319: Cleartext Transmission of Sensitive Information CWE-325: Missing Cryptographic Step •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2022-27782 – curl: TLS and SSH connection too eager reuse
https://notcve.org/view.php?id=CVE-2022-27782
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily. libcurl reusaba una conexión creada previamente incluso cuando había sido cambiada una opción relacionada con TLS o SSH que debería haber prohibido el reúso. libcurl mantiene las conexiones usadas previamente en un pool de conexiones para que las transferencias posteriores las reúsen si una de ellas coincide con la configuración. Sin embargo, varias opciones relacionadas con TLS y SSH se dejaron fuera de las comprobaciones de coincidencia de la configuración, lo que hizo que coincidieran con demasiada facilidad A vulnerability was found in curl. This issue occurs because curl can reuse a previously created connection even when a TLS or SSH-related option is changed that should have prohibited reuse. This flaw leads to an authentication bypass, either by mistake or by a malicious actor. • http://www.openwall.com/lists/oss-security/2023/03/20/6 https://hackerone.com/reports/1555796 https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html https://security.gentoo.org/glsa/202212-01 https://security.netapp.com/advisory/ntap-20220609-0009 https://www.debian.org/security/2022/dsa-5197 https://access.redhat.com/security/cve/CVE-2022-27782 https://bugzilla.redhat.com/show_bug.cgi?id=2082215 • CWE-295: Improper Certificate Validation CWE-840: Business Logic Errors •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 1CVE-2022-27781 – curl: CERTINFO never-ending busy-loop
https://notcve.org/view.php?id=CVE-2022-27781
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation. libcurl proporciona la opción "CURLOPT_CERTINFO" para permitir que las aplicaciones soliciten que se devuelvan detalles sobre la cadena de certificados de un servidor. Debido a una función errónea, un servidor malicioso podría hacer que libcurl construido conNSS quedara atascado en un bucle ocupado interminable cuando intentara recuperar esa información A vulnerability was found in curl. This issue occurs due to an erroneous function. A malicious server could make curl within Network Security Services (NSS) get stuck in a never-ending busy loop when trying to retrieve that information. This flaw allows an Infinite Loop, affecting system availability. • https://hackerone.com/reports/1555441 https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html https://security.gentoo.org/glsa/202212-01 https://security.netapp.com/advisory/ntap-20220609-0009 https://www.debian.org/security/2022/dsa-5197 https://access.redhat.com/security/cve/CVE-2022-27781 https://bugzilla.redhat.com/show_bug.cgi?id=2082204 • CWE-400: Uncontrolled Resource Consumption CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 1CVE-2022-27780
https://notcve.org/view.php?id=CVE-2022-27780
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more. El analizador de URLs de Curl acepta erróneamente separadores de URL codificados en porcentaje, como "/", cuando decodifica la parte del nombre del host de una URL, convirtiéndola en una URL *diferente* que usa un nombre de host incorrecto cuando es recuperado posteriormente. Por ejemplo, una URL como "http://example.com%2F127.0.0.1/", sería permitida por el analizador y sería transpuesta a "http://example.com/127.0.0.1/". Este fallo puede usarse para omitir filtros, comprobaciones y otras cosas • https://hackerone.com/reports/1553841 https://security.gentoo.org/glsa/202212-01 https://security.netapp.com/advisory/ntap-20220609-0009 • CWE-177: Improper Handling of URL Encoding (Hex Encoding) CWE-918: Server-Side Request Forgery (SSRF) •