CVE-2022-32206
CVE-2022-32206
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
CVSS 6.5 · Mittel · EPSS 36,3% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: system
Betroffene Produkte und Versionen
https://github.com/curl/curl
- Softwareversionen
- Fixed in 7.84.0: Betroffen
Keine Korrektur veröffentlicht
curl Debian:12
- Betroffene Versionsbereiche
- ECOSYSTEM: < 7.84.0-1
Auf 7.84.0-1 aktualisieren
curl Debian:13
- Betroffene Versionsbereiche
- ECOSYSTEM: < 7.84.0-1
Auf 7.84.0-1 aktualisieren
curl Debian:14
- Betroffene Versionsbereiche
- ECOSYSTEM: < 7.84.0-1
Auf 7.84.0-1 aktualisieren
curl Ubuntu:18.04:LTS
- Softwareversionen
- 7.55.1-1ubuntu2
- 7.55.1-1ubuntu2.1
- 7.57.0-1ubuntu1
- 7.58.0-2ubuntu1
- 7.58.0-2ubuntu2
- 7.58.0-2ubuntu3
- 7.58.0-2ubuntu3.1
- 7.58.0-2ubuntu3.2
- 7.58.0-2ubuntu3.3
- 7.58.0-2ubuntu3.5
- 7.58.0-2ubuntu3.6
- 7.58.0-2ubuntu3.7
- 7.58.0-2ubuntu3.8
- 7.58.0-2ubuntu3.9
- 7.58.0-2ubuntu3.10
- 7.58.0-2ubuntu3.12
- 7.58.0-2ubuntu3.13
- 7.58.0-2ubuntu3.14
- 7.58.0-2ubuntu3.15
- 7.58.0-2ubuntu3.16
- 7.58.0-2ubuntu3.17
- 7.58.0-2ubuntu3.18
- Betroffene Versionsbereiche
- ECOSYSTEM: < 7.58.0-2ubuntu3.19
Auf 7.58.0-2ubuntu3.19 aktualisieren
curl Ubuntu:20.04:LTS
- Softwareversionen
- 7.65.3-1ubuntu3
- 7.65.3-1ubuntu4
- 7.66.0-1ubuntu1
- 7.67.0-2ubuntu1
- 7.68.0-1ubuntu1
- 7.68.0-1ubuntu2
- 7.68.0-1ubuntu2.1
- 7.68.0-1ubuntu2.2
- 7.68.0-1ubuntu2.4
- 7.68.0-1ubuntu2.5
- 7.68.0-1ubuntu2.6
- 7.68.0-1ubuntu2.7
- 7.68.0-1ubuntu2.10
- 7.68.0-1ubuntu2.11
- Betroffene Versionsbereiche
- ECOSYSTEM: < 7.68.0-1ubuntu2.12
Auf 7.68.0-1ubuntu2.12 aktualisieren
curl Ubuntu:22.04:LTS
- Softwareversionen
- 7.74.0-1.3ubuntu2
- 7.74.0-1.3ubuntu3
- 7.80.0-3
- 7.81.0-1
- 7.81.0-1ubuntu1.1
- 7.81.0-1ubuntu1.2
- Betroffene Versionsbereiche
- ECOSYSTEM: < 7.81.0-1ubuntu1.3
Auf 7.81.0-1ubuntu1.3 aktualisieren
Originalquellen
- https://hackerone.com/reports/1570651
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
- https://www.debian.org/security/2022/dsa-5197
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
- https://security.netapp.com/advisory/ntap-20220915-0003/
- https://support.apple.com/kb/HT213488
- http://seclists.org/fulldisclosure/2022/Oct/41
- http://seclists.org/fulldisclosure/2022/Oct/28
- https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
- https://security.gentoo.org/glsa/202212-01
- http://www.openwall.com/lists/oss-security/2023/02/15/3
- https://cert-portal.siemens.com/productcert/html/ssa-333517.html
- https://cert-portal.siemens.com/productcert/html/ssa-419740.html
- https://cert-portal.siemens.com/productcert/html/ssa-558014.html
- https://cert-portal.siemens.com/productcert/html/ssa-942865.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-32206