CVE-2022-27775

Vulnerability

An information disclosure vulnerability exists in curl versions 7.65.0 through 7.82.0. The connection reuse logic incorrectly matches IPv6 addresses with different zone IDs, causing curl to reuse a connection intended for a different destination. This can lead to unintended data exposure. [1]

Exploitation

An attacker must be able to influence the zone ID in an IPv6 address used by curl, for example by controlling a URL or redirect. When curl's connection pool contains an entry for an IPv6 address with a different zone ID, the attacker can cause curl to reuse that connection, sending data to an unintended host. [1]

Impact

Successful exploitation results in information disclosure, as data intended for one host may be sent to another host due to connection reuse. The attacker could receive sensitive information meant for a different destination. [1]

Mitigation

The vulnerability is fixed in curl version 7.83.0 and later. Users should upgrade to at least curl 7.83.0. The Gentoo security advisory recommends upgrading to >=net-misc/curl-7.86.0. No workaround is available. [1]