// For flags

CVE-2022-42915

curl: HTTP proxy double-free

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.

curl antes de la versión 7.86.0 tiene un double free. Si se le dice a curl que use un proxy HTTP para una transferencia con una URL que no sea HTTP(S), configura la conexión al servidor remoto emitiendo una solicitud CONNECT al proxy y luego canaliza el resto del protocolo. Un proxy HTTP podría rechazar esta solicitud (los proxy HTTP a menudo solo permiten conexiones salientes a números de puerto específicos, como 443 para HTTPS) y en su lugar devolver un código de estado distinto de 200 al cliente. Debido a fallas en el manejo de errores/limpieza, esto podría desencadenar un double free in curl si se usara uno de los siguientes esquemas en la URL para la transferencia: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps o telnet. La primera versión afectada es la 7.77.0.

A vulnerability was found in curl. The issue occurs if curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL. It sets up the connection to the remote server by issuing a `CONNECT` request to the proxy and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 response code to the client. Due to flaws in the error/cleanup handling, this could trigger a double-free issue in curl if using one of the following schemes in the URL for the transfer: `dict,` `gopher,` `gophers,` `ldap`, `ldaps`, `rtmp`, `rtmps`, `telnet.`

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-10-13 CVE Reserved
  • 2022-10-27 CVE Published
  • 2024-06-19 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-415: Double Free
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Netapp
Search vendor "Netapp"
H300s Firmware
Search vendor "Netapp" for product "H300s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H300s
Search vendor "Netapp" for product "H300s"
--
Safe
Netapp
Search vendor "Netapp"
H500s Firmware
Search vendor "Netapp" for product "H500s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H500s
Search vendor "Netapp" for product "H500s"
--
Safe
Netapp
Search vendor "Netapp"
H700s Firmware
Search vendor "Netapp" for product "H700s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H700s
Search vendor "Netapp" for product "H700s"
--
Safe
Netapp
Search vendor "Netapp"
H410s Firmware
Search vendor "Netapp" for product "H410s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H410s
Search vendor "Netapp" for product "H410s"
--
Safe
Haxx
Search vendor "Haxx"
Curl
Search vendor "Haxx" for product "Curl"
>= 7.77.0 < 7.86.0
Search vendor "Haxx" for product "Curl" and version " >= 7.77.0 < 7.86.0"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
35
Search vendor "Fedoraproject" for product "Fedora" and version "35"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
36
Search vendor "Fedoraproject" for product "Fedora" and version "36"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
37
Search vendor "Fedoraproject" for product "Fedora" and version "37"
-
Affected
Netapp
Search vendor "Netapp"
Ontap 9
Search vendor "Netapp" for product "Ontap 9"
--
Affected
Apple
Search vendor "Apple"
Macos
Search vendor "Apple" for product "Macos"
>= 12.0.0 < 12.6.3
Search vendor "Apple" for product "Macos" and version " >= 12.0.0 < 12.6.3"
-
Affected
Apple
Search vendor "Apple"
Macos
Search vendor "Apple" for product "Macos"
>= 13.0 < 13.2
Search vendor "Apple" for product "Macos" and version " >= 13.0 < 13.2"
-
Affected
Splunk
Search vendor "Splunk"
Universal Forwarder
Search vendor "Splunk" for product "Universal Forwarder"
>= 8.2.0 < 8.2.12
Search vendor "Splunk" for product "Universal Forwarder" and version " >= 8.2.0 < 8.2.12"
-
Affected
Splunk
Search vendor "Splunk"
Universal Forwarder
Search vendor "Splunk" for product "Universal Forwarder"
>= 9.0.0 < 9.0.6
Search vendor "Splunk" for product "Universal Forwarder" and version " >= 9.0.0 < 9.0.6"
-
Affected
Splunk
Search vendor "Splunk"
Universal Forwarder
Search vendor "Splunk" for product "Universal Forwarder"
9.1.0
Search vendor "Splunk" for product "Universal Forwarder" and version "9.1.0"
-
Affected