Vulnerability CVE-2022-32208: Information

Description

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Severity: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-32208
Published: July 7, 2022
Modified: March 27, 2024
Error type identifier: CWE-787

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
curlsisyphus7.84.0-alt28.7.1-alt2ALT-PU-2022-2421-1305064Fixed
curlsisyphus_e2k7.85.0-alt18.7.1-alt2ALT-PU-2022-5943-1-Fixed
curlsisyphus_riscv647.84.0-alt0.2.rv648.7.1-alt2ALT-PU-2022-5757-1-Fixed
curlp107.85.0-alt18.7.1-alt2ALT-PU-2022-2588-1306026Fixed
curlp10_e2k7.85.0-alt18.7.1-alt1ALT-PU-2022-6108-1-Fixed
curlc10f17.85.0-alt18.6.0-alt1ALT-PU-2022-2588-1306026Fixed
curlc9f27.85.0-alt18.6.0-alt1ALT-PU-2022-2874-1306293Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://hackerone.com/reports/1590071
  • Exploit
  • Third Party Advisory
DSA-5197
  • Third Party Advisory
[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update
  • Mailing List
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20220915-0003/
  • Third Party Advisory
https://support.apple.com/kb/HT213488
  • Third Party Advisory
20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13
  • Mailing List
  • Third Party Advisory
20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13
  • Mailing List
  • Third Party Advisory
GLSA-202212-01
  • Third Party Advisory
FEDORA-2022-1b3d7f6973
  • Mailing List
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
      Start including
      7.16.4
      End excliding
      7.84.0

      Configuration 2

      cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
      cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
      cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
      cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*

      Configuration 5

      Running on/with:
      cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
      cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

      Configuration 6

      Running on/with:
      cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
      cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

      Configuration 7

      Running on/with:
      cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
      cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

      Configuration 8

      Running on/with:
      cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
      cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

      Configuration 9

      cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

      Configuration 10

      cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
      End excliding
      13.0

      Configuration 11

      cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
      cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
      Start including
      9.0.0
      End excliding
      9.0.6
      cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
      Start including
      8.2.0
      End excliding
      8.2.12
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.4.2
Back to top