Orta CVSS 6.5 PoC var

CVE-2022-32206: Curl: güvenlik açığı

Yayın: 7 Temmuz 2022 16:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

Özet bilgiler

Ürün: Haxx Curl
CVSS v3.1: 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: %36,35 (yüzdelik 98)
CWE: CWE-770
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
haxx-curl	—	—	7.84.0
fedoraproject-fedora	35	35	—
debian-debian-linux	10.0	10.0	—
debian-debian-linux	11.0	11.0	—
netapp-clustered-data-ontap	—	—	—
netapp-element-software	—	—	—
netapp-hci-management-node	—	—	—
netapp-solidfire	—	—	—
netapp-bootstrap-os	—	—	—
netapp-h300s-firmware	—	—	—
netapp-h500s-firmware	—	—	—
netapp-h700s-firmware	—	—	—
netapp-h410s-firmware	—	—	—
siemens-scalance-sc622-2c-firmware	—	—	3.0
siemens-scalance-sc626-2c-firmware	—	—	3.0
siemens-scalance-sc632-2c-firmware	—	—	3.0
siemens-scalance-sc636-2c-firmware	—	—	3.0
siemens-scalance-sc642-2c-firmware	—	—	3.0
siemens-scalance-sc646-2c-firmware	—	—	3.0
splunk-universal-forwarder	8.2.0	—	8.2.12
splunk-universal-forwarder	9.0.0	—	9.0.6
splunk-universal-forwarder	9.1.0	9.1.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları