CVE-2022-32206
Summary
| CVE | CVE-2022-32206 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-07-07 13:15:00 UTC |
|---|
| Updated | 2024-03-27 15:00:00 UTC |
|---|
| Description | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Full Disclosure: APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13 |
FULLDISC |
seclists.org |
|
| curl: Multiple Vulnerabilities (GLSA 202212-01) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| About the security content of macOS Ventura 13 - Apple Support |
CONFIRM |
support.apple.com |
|
| [SECURITY] Fedora 35 Update: curl-7.79.1-5.fc35 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf |
CONFIRM |
cert-portal.siemens.com |
|
| [SECURITY] Fedora 35 Update: curl-7.79.1-5.fc35 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| July 2022 Libcurl Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| HackerOne |
MISC |
hackerone.com |
|
| oss-security - curl: CVE-2023-23916: HTTP multi-header compression denial of
service |
MLIST |
www.openwall.com |
|
| Full Disclosure: APPLE-SA-2022-10-24-2 macOS Ventura 13 |
FULLDISC |
seclists.org |
|
| Debian -- Security Information -- DSA-5197-1 curl |
DEBIAN |
www.debian.org |
|
| [SECURITY] [DLA 3085-1] curl security update |
MLIST |
lists.debian.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160059 Oracle Enterprise Linux Security Update for curl (ELSA-2022-6159)
- 160064 Oracle Enterprise Linux Security Update for curl (ELSA-2022-6157)
- 180909 Debian Security Update for curl (DSA 5197-1)
- 180969 Debian Security Update for curl (DLA 3085-1)
- 184922 Debian Security Update for curl (CVE-2022-32206)
- 198842 Ubuntu Security Notification for curl Vulnerabilities (USN-5495-1)
- 240634 Red Hat Update for curl (RHSA-2022:6157)
- 240636 Red Hat Update for curl (RHSA-2022:6159)
- 240996 Red Hat Update for JBoss Core Services (RHSA-2022:8840)
- 241641 Red Hat Update for curl (RHSA-2023:3460)
- 282881 Fedora Security Update for curl (FEDORA-2022-8bd3bf5b40)
- 282944 Fedora Security Update for curl (FEDORA-2022-1b3d7f6973)
- 330140 IBM AIX Multiple Vulnerabilities due to curl (curl_advisory2)
- 354105 Amazon Linux Security Advisory for curl : ALAS2-2022-1875
- 354255 Amazon Linux Security Advisory for curl : ALAS-2022-1646
- 354292 Amazon Linux Security Advisory for curl : ALAS2022-2022-206
- 354377 Amazon Linux Security Advisory for curl : ALAS2022-2022-145
- 354587 Amazon Linux Security Advisory for curl : ALAS-2022-206
- 355207 Amazon Linux Security Advisory for curl : ALAS2023-2023-083
- 377340 Alibaba Cloud Linux Security Update for curl (ALINUX3-SA-2022:0155)
- 378599 Splunk Enterprise Third Party Package Updates for June (SVD-2023-0613)
- 378883 Splunk Enterprise August Third Party Package Updates (SVD-2023-0808)
- 502407 Alpine Linux Security Update for curl
- 502408 Alpine Linux Security Update for curl
- 502409 Alpine Linux Security Update for curl
- 502715 Alpine Linux Security Update for curl
- 505611 Alpine Linux Security Update for curl
- 591257 Siemens SCALANCE SC-600 Family Multiple Vulnerabilities (ICSA-22-349-18, SSA-333517)
- 591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
- 672121 EulerOS Security Update for curl (EulerOS-SA-2022-2310)
- 672161 EulerOS Security Update for curl (EulerOS-SA-2022-2426)
- 672168 EulerOS Security Update for curl (EulerOS-SA-2022-2413)
- 672198 EulerOS Security Update for curl (EulerOS-SA-2022-2454)
- 690887 Free Berkeley Software Distribution (FreeBSD) Security Update for curl (ae5722a6-f5f0-11ec-856e-d4c9ef517024)
- 710693 Gentoo Linux curl Multiple Vulnerabilities (GLSA 202212-01)
- 752300 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2022:2288-1)
- 752314 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2022:2305-1)
- 752320 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2022:2327-1)
- 752476 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2022:2813-1)
- 752478 SUSE Enterprise Linux Security Update for curl (SUSE-SU-2022:2829-1)
- 902456 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (10110)
- 902470 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (10098)
- 902553 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (10114)
- 902642 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (10102-1)
- 903726 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (10114-1)
- 940641 AlmaLinux Security Update for curl (ALSA-2022:6159)
- 940646 AlmaLinux Security Update for curl (ALSA-2022:6157)
- 960165 Rocky Linux Security Update for curl (RLSA-2022:6159)
- 960573 Rocky Linux Security Update for curl (RLSA-2022:6157)
