NA

CVE-2022-35252

Published: 23/09/2022 Updated: 27/03/2024
CVSS v3 Base Score: 3.7 | Impact Score: 1.4 | Exploitability Score: 2.2
VMScore: 0

Vulnerability Summary

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

haxx curl

netapp element software -

netapp clustered data ontap -

netapp solidfire -

netapp hci management node -

netapp bootstrap_os -

netapp h300s_firmware -

netapp h500s_firmware -

netapp h700s_firmware -

netapp h410s_firmware -

apple macos

debian debian linux 10.0

splunk universal forwarder 9.1.0

splunk universal forwarder

Vendor Advisories

Debian Bug report logs - #1018831 curl: CVE-2022-35252: control code in cookie denial of service Package: src:curl; Maintainer for src:curl is Alessandro Ghedini <ghedo@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 31 Aug 2022 12:36:01 UTC Severity: important Tags: security, upstream ...
Synopsis Low: curl security update Type/Severity Security Advisory: Low Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for curl is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as having a security impact of ...
Synopsis Low: curl security and bug fix update Type/Severity Security Advisory: Low Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for curl is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a securi ...
Synopsis Important: Self Node Remediation Operator 051 security update Type/Severity Security Advisory: Important Topic This is an updated version of the Self Node Remediation Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Commo ...
Synopsis Moderate: Red Hat JBoss Core Services Apache HTTP Server 2451 SP1 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat JBoss Core ServicesRed Hat Product Securi ...
Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2451 SP1 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Core ServicesRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base sco ...
A vulnerability was found in curl This issue occurs because a malicious server can serve excessive amounts of `Set-Cookie:` headers in an HTTP response to curl, which stores all of them This flaw leads to a denial of service, either by mistake or by a malicious actor (CVE-2022-32205) A vulnerability was found in curl This issue occurs because t ...
A vulnerability was found in curl This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials set for this transfer This issue leads to an authentication bypass, either by mistake or by a malicious actor (CVE-2022-22576) A vulnerability was found in ...
A vulnerability was found in curl This issue occurs because a malicious server can serve excessive amounts of `Set-Cookie:` headers in an HTTP response to curl, which stores all of them This flaw leads to a denial of service, either by mistake or by a malicious actor (CVE-2022-32205) A vulnerability was found in curl This issue occurs because t ...
A vulnerability was found in curl This issue occurs because a malicious server can serve excessive amounts of `Set-Cookie:` headers in an HTTP response to curl, which stores all of them This flaw leads to a denial of service, either by mistake or by a malicious actor (CVE-2022-32205) A vulnerability was found in curl This issue occurs because t ...