Published: 02/06/2022 Updated: 27/03/2024

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx curl
debian debian linux 10.0
debian debian linux 11.0
netapp hci_bootstrap_os -
netapp clustered data ontap -
netapp solidfire \\& hci management node -
netapp hci compute node -
netapp solidfire\\, enterprise sds \\& hci storage node -
netapp h300s_firmware -
netapp h500s_firmware -
netapp h700s_firmware -
netapp h410s_firmware -
splunk universal forwarder 9.1.0
splunk universal forwarder

Several security issues were fixed in curl ...

Multiple security vulnerabilities have been discovered in cURL, an URL transfer library These flaws may allow remote attackers to obtain sensitive information, leak authentication or cookie header data or facilitate a denial of service attack For the stable distribution (bullseye), these problems have been fixed in version 7740-13+deb11u2 We ...

A vulnerability was found in curl This issue occurs due to an erroneous function A malicious server could make curl within Network Security Services (NSS) get stuck in a never-ending busy loop when trying to retrieve that information This flaw allows an Infinite Loop, affecting system availability (CVE-2022-27781) A vulnerability was found in c ...

A vulnerability was found in curl This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials set for this transfer This issue leads to an authentication bypass, either by mistake or by a malicious actor (CVE-2022-22576) A vulnerability was found in ...

libcurl provides the `CURLOPT_CERTINFO` option to allow applications to request details to be returned about a TLS server's certificate chain Due to an erroneous function, a malicious server could make libcurl built with NSS get stuck in a never-ending busy-loop when trying to retrieve that information ...

Critical Infrastructure Sectors: Critical Manufacturing

CWE-835 https://hackerone.com/reports/1555441 https://security.netapp.com/advisory/ntap-20220609-0009/https://www.debian.org/security/2022/dsa-5197 https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html https://security.gentoo.org/glsa/202212-01 https://ubuntu.com/security/notices/USN-5499-1 https://ubuntu.com/security/notices/USN-5412-1 https://nvd.nist.gov https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10

CVE-2022-27781

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

References

Vulmon Search

About

Products

Connect