CVE-2022-27782
Published on: Not Yet Published
Last Modified on: 08/29/2022 01:15:00 AM UTC
Certain versions of Curl from Haxx contain the following vulnerability:
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.
- CVE-2022-27782 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity.
CVSS3 Score: 7.5 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | NONE | HIGH | NONE |
CVSS2 Score: 5 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | LOW | NONE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| NONE | PARTIAL | NONE |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| June 2022 Libcurl Vulnerabilities in NetApp Products | NetApp Product Security | security.netapp.com text/html |
CONFIRM security.netapp.com/advisory/ntap-20220609-0009/ |
| HackerOne | hackerone.com text/html |
MISC hackerone.com/reports/1555796 |
| Debian -- Security Information -- DSA-5197-1 curl | www.debian.org Depreciated Link text/html |
DEBIAN DSA-5197 |
| [SECURITY] [DLA 3085-1] curl security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update |
Related QID Numbers
- 159919 Oracle Enterprise Linux Security Update for curl (ELSA-2022-5313)
- 159933 Oracle Enterprise Linux Security Update for curl (ELSA-2022-5245)
- 180909 Debian Security Update for curl (DSA 5197-1)
- 180969 Debian Security Update for curl (DLA 3085-1)
- 198780 Ubuntu Security Notification for curl Vulnerabilities (USN-5412-1)
- 240502 Red Hat Update for curl (RHSA-2022:5245)
- 240504 Red Hat Update for curl (RHSA-2022:5313)
- 282695 Fedora Security Update for curl (FEDORA-2022-3d8f00cde2)
- 282696 Fedora Security Update for curl (FEDORA-2022-d15a736748)
- 282754 Fedora Security Update for curl (FEDORA-2022-8277bef335)
- 296082 Oracle Solaris 11.4 Support Repository Update (SRU) 48.126.1 Missing (CPUJUL2022)
- 353981 Amazon Linux Security Advisory for curl : ALAS2-2022-1808
- 377351 Alibaba Cloud Linux Security Update for curl (ALINUX3-SA-2022:0142)
- 502213 Alpine Linux Security Update for curl
- 502407 Alpine Linux Security Update for curl
- 502408 Alpine Linux Security Update for curl
- 672028 EulerOS Security Update for curl (EulerOS-SA-2022-2238)
- 672030 EulerOS Security Update for curl (EulerOS-SA-2022-2251)
- 672064 EulerOS Security Update for curl (EulerOS-SA-2022-2217)
- 672121 EulerOS Security Update for curl (EulerOS-SA-2022-2310)
- 690868 Free Berkeley Software Distribution (FreeBSD) Security Update for curl (11e36890-d28c-11ec-a06f-d4c9ef517024)
- 752149 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2022:1733-1)
- 752162 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2022:1805-1)
- 752185 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2022:1870-1)
- 752476 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2022:2813-1)
- 752478 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2022:2829-1)
- 902152 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (9868)
- 902157 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (9877)
- 902379 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (9877-1)
- 903727 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (9868-1)
- 940598 AlmaLinux Security Update for curl (ALSA-2022:5313)
- 960152 Rocky Linux Security Update for curl (RLSA-2022:5313)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Haxx | Curl | All | All | All | All |
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @rgacogne |
@bagder It looks like curl.se/docs/CVE-2022-… yields a 404, while listed on curl.se/docs/security.… | 2022-05-11 07:07:04 |
| @sidfm_jp |
cURL に TLS および SSH 接続を不正に再利用する問題 (CVE-2022-27782) [42172] sid.softek.jp/content/show/4… #SIDfm #脆弱性情報 | 2022-05-12 08:00:09 |
| @RedPacketSec |
cURL libcurl security bypass | CVE-2022-27782 - redpacketsecurity.com/curl-libcurl-s… | 2022-05-12 09:01:18 |
| @louise01067 |
Internet Bug Bounty: CVE-2022-27782: TLS and SSH connection too eager reuse replug.link/270f5440 | 2022-05-16 01:52:10 |
| @CVEreport |
cve.report/CVE-2022-27782 libcurl would reuse a previously created connection even when a TLS or SSHrelated option h… twitter.com/i/web/status/1… | 2022-06-02 16:36:40 |
 /r/opnsense |
already curl-7.83.0 is vulnerable: | 2022-05-13 21:52:27 |