CVE-2022-27775
CVE-2022-27775
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
CVSS 7.5 · High · EPSS 3.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
https://github.com/curl/curl
- Versions
- curl 7.65.0 to 7.82.0 are vulnerable: Affected
No fix published
curl Debian:12
- Affected ranges
- ECOSYSTEM: < 7.83.0-1
Update to 7.83.0-1
curl Debian:13
- Affected ranges
- ECOSYSTEM: < 7.83.0-1
Update to 7.83.0-1
curl Debian:14
- Affected ranges
- ECOSYSTEM: < 7.83.0-1
Update to 7.83.0-1
curl Ubuntu:20.04:LTS
- Versions
- 7.65.3-1ubuntu3
- 7.65.3-1ubuntu4
- 7.66.0-1ubuntu1
- 7.67.0-2ubuntu1
- 7.68.0-1ubuntu1
- 7.68.0-1ubuntu2
- 7.68.0-1ubuntu2.1
- 7.68.0-1ubuntu2.2
- 7.68.0-1ubuntu2.4
- 7.68.0-1ubuntu2.5
- 7.68.0-1ubuntu2.6
- 7.68.0-1ubuntu2.7
- Affected ranges
- ECOSYSTEM: < 7.68.0-1ubuntu2.10
Update to 7.68.0-1ubuntu2.10
curl Ubuntu:22.04:LTS
- Versions
- 7.74.0-1.3ubuntu2
- 7.74.0-1.3ubuntu3
- 7.80.0-3
- 7.81.0-1
- Affected ranges
- ECOSYSTEM: < 7.81.0-1ubuntu1.1
Update to 7.81.0-1ubuntu1.1