CVE-2022-32207Critical· 9.8▾ AbyssalPoC availableWhen curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accide…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 2.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
7.7%
Exploit / PoC code exists
7.7% → 12%
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated file accessible to more users than intended.
curl >= 7.69.0, < 7.84.0fedora = 35debian_linux = 11.0clustered_data_ontapelement_softwarehci_management_nodesolidfirebootstrap_osh300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwaremacos < 13.0universal_forwarder >= 8.2.0, < 8.2.12universal_forwarder >= 9.0.0, < 9.0.6universal_forwarder = 9.1.0Upgrade past the affected range:
curl 7.84.0macos 13.0universal_forwarder 9.0.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-32208Medium· 5.9When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly
CVE-2022-27782High· 7.5libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse i…
CVE-2021-22926High· 7.5libcurl-using applications can ask for a specific client certificate to be used in a transfer
CVE-2021-22922Medium· 6.5When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of diff…
CVE-2022-35260Medium· 6.5curl can be told to parse a `.netrc` file for credentials
CVE-2022-35252Low· 3.7When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses