rpm package
opensuse/curl&distro=openSUSE Leap 15.4
pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.4
Vulnerabilities (26)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-42916 | — | < 7.79.1-150400.5.9.1 | 7.79.1-150400.5.9.1 | Oct 29, 2022 | In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypas | ||
| CVE-2022-35252 | — | < 7.79.1-150400.5.6.1 | 7.79.1-150400.5.6.1 | Sep 23, 2022 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings. | ||
| CVE-2022-32208 | — | < 7.79.1-150400.5.3.1 | 7.79.1-150400.5.3.1 | Jul 7, 2022 | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. | ||
| CVE-2022-32207 | — | < 7.79.1-150400.5.3.1 | 7.79.1-150400.5.3.1 | Jul 7, 2022 | When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the targ | ||
| CVE-2022-32206 | — | < 7.79.1-150400.5.3.1 | 7.79.1-150400.5.3.1 | Jul 7, 2022 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to ins | ||
| CVE-2022-32205 | — | < 7.79.1-150400.5.3.1 | 7.79.1-150400.5.3.1 | Jul 7, 2022 | A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create request |
- CVE-2022-42916Oct 29, 2022affected < 7.79.1-150400.5.9.1fixed 7.79.1-150400.5.9.1
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypas
- CVE-2022-35252Sep 23, 2022affected < 7.79.1-150400.5.6.1fixed 7.79.1-150400.5.6.1
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
- CVE-2022-32208Jul 7, 2022affected < 7.79.1-150400.5.3.1fixed 7.79.1-150400.5.3.1
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
- CVE-2022-32207Jul 7, 2022affected < 7.79.1-150400.5.3.1fixed 7.79.1-150400.5.3.1
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the targ
- CVE-2022-32206Jul 7, 2022affected < 7.79.1-150400.5.3.1fixed 7.79.1-150400.5.3.1
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to ins
- CVE-2022-32205Jul 7, 2022affected < 7.79.1-150400.5.3.1fixed 7.79.1-150400.5.3.1
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create request
Page 2 of 2