CVE-2022-27782

Katalog CVE

CVSS 7.5 · High EPSS 2,9%

Kerentanan Business Logic Errors pada haxx curl, debian linux +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Rincian

Terbit di NVD

2 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-840: Business Logic Errors
CWE-295: Improper Certificate Validation

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://hackerone.com/reports/1555796 exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202212-01 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220609-0009/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5197 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/03/20/6 mailing list