CVE-2022-32205

Katalog CVE

CVSS 4.3 · Medium EPSS 27,9%

Kerentanan Allocation of Resources Without Limits or Throttling pada haxx curl, fedoraproject fedora +17 lainnya. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.

Rincian

Terbit di NVD

7 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

27,9% peluang dieksploitasi; lebih tinggi dari 98,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf patch · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2022/Oct/28 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2022/Oct/41 mailing list · advisory pihak ketiga
• https://hackerone.com/reports/1569946 exploit · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CE... mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202212-01 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220915-0003/ advisory pihak ketiga
• https://support.apple.com/kb/HT213488 advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5197 advisory pihak ketiga