CVE-2022-30115

Katalog CVE

CVSS 4.3 · Medium EPSS 1,3%

Kerentanan Missing Cryptographic Step pada haxx curl, netapp hci bootstrap os +8 lainnya. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.

Rincian

Terbit di NVD

2 Juni 2022

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-325: Missing Cryptographic Step
CWE-319: Cleartext Transmission of Sensitive Information

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2022/10/26/4 mailing list · patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2022/12/21/1 mailing list · advisory pihak ketiga
• https://hackerone.com/reports/1557449 exploit · advisory pihak ketiga
• https://security.gentoo.org/glsa/202212-01 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220609-0009/ advisory pihak ketiga