Lucene search

[email protected]CVE-2022-27779

HistoryJun 02, 2022 - 2:15 p.m.

CVE-2022-27779

2022-06-0214:15:44

CWE-201

[email protected]

web.nvd.nist.gov

155

cve-2022-27779

libcurl

top level domains

security vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.3%

JSON

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl’s “cookie engine” can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

Affected configurations

NVD

Node

haxxcurlRange7.82.0–7.83.1

Node

netapphci_bootstrap_osMatch-

AND

netapphci_compute_nodeMatch-

Node

netappclustered_data_ontapMatch-

netappsolidfire\,_enterprise_sds_\&_hci_storage_nodeMatch-

netappsolidfire_\&_hci_management_nodeMatch-

netapphci_compute_nodeMatch-

Node

netapph410s_firmwareMatch-

AND

netapph410sMatch-

Node

netapph700s_firmwareMatch-

AND

netapph700sMatch-

Node

netapph500s_firmwareMatch-

AND

netapph500sMatch-

Node

netapph300s_firmwareMatch-

AND

netapph300sMatch-

Node

splunkuniversal_forwarderRange8.2.0–8.2.12

splunkuniversal_forwarderRange9.0.0–9.0.6

splunkuniversal_forwarderMatch9.1.0

CPENameOperatorVersion
haxx:curlhaxx curllt7.83.1

CPE	Name	Operator	Version
haxx:curl	haxx curl	lt	7.83.1

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/curl/curl",
    "versions": [
      {
        "version": "Fixed in 7.83.1",
        "status": "affected"
      }
    ]
  }
]