CVE-2022-35252

2022-09-2314:15:12

Google

osv.dev

curl

control codes

http server

error responses

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

0.001 Low

EPSS

Percentile

50.9%

JSON

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

CPENameOperatorVersion
curleqcurl-7_52_1
curleq7.62.0-r1
curleqcurl-7_10_2
curleqcurl-7_50_1
curleq7.33.0-r0
curleqCurl_easy_1-1-8
curleq7.79.0-r1
curleqcurl-7_18_0
curleq7.21.7-r1
curleq7.80.0-r2

Name	Operator	Version
curl	eq	curl-7_52_1
curl	eq	7.62.0-r1
curl	eq	curl-7_10_2
curl	eq	curl-7_50_1
curl	eq	7.33.0-r0
curl	eq	Curl_easy_1-1-8
curl	eq	7.79.0-r1
curl	eq	curl-7_18_0
curl	eq	7.21.7-r1
curl	eq	7.80.0-r2