Vulnerability CVE-2022-32207: Information

Description

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

Severity: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-32207
Published: July 7, 2022
Modified: March 27, 2024
Error type identifier: CWE-276

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
curlsisyphus7.84.0-alt28.7.1-alt2ALT-PU-2022-2421-1305064Fixed
curlsisyphus_e2k7.85.0-alt18.7.1-alt2ALT-PU-2022-5943-1-Fixed
curlsisyphus_riscv647.84.0-alt0.2.rv648.7.1-alt2ALT-PU-2022-5757-1-Fixed
curlp107.85.0-alt18.7.1-alt2ALT-PU-2022-2588-1306026Fixed
curlp10_e2k7.85.0-alt18.7.1-alt2ALT-PU-2022-6108-1-Fixed
curlc10f17.85.0-alt18.6.0-alt1ALT-PU-2022-2588-1306026Fixed
curlc9f27.85.0-alt18.6.0-alt1ALT-PU-2022-2874-1306293Fixed
curlp117.84.0-alt28.7.1-alt2ALT-PU-2022-2421-1305064Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://hackerone.com/reports/1573634
  • Exploit
  • Third Party Advisory
DSA-5197
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20220915-0003/
  • Third Party Advisory
https://support.apple.com/kb/HT213488
  • Third Party Advisory
20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13
  • Mailing List
  • Third Party Advisory
20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13
  • Mailing List
  • Third Party Advisory
GLSA-202212-01
  • Third Party Advisory
FEDORA-2022-1b3d7f6973
  • Mailing List
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
      Start including
      7.69.0
      End excliding
      7.84.0

      Configuration 2

      cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
      cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
      cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
      cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*

      Configuration 5

      Running on/with:
      cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
      cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

      Configuration 6

      Running on/with:
      cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
      cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

      Configuration 7

      Running on/with:
      cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
      cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

      Configuration 8

      Running on/with:
      cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
      cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

      Configuration 9

      Running on/with:
      cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
      cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

      Configuration 10

      cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
      End excliding
      13.0

      Configuration 11

      cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
      cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
      Start including
      9.0.0
      End excliding
      9.0.6
      cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
      Start including
      8.2.0
      End excliding
      8.2.12
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top