Information disclosure in cURL - CVE-2022-27774

Vulnerability identifier: #VU62641

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-27774

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to curl attempts to follow redirects during authentication process and does not consider different port numbers or protocols to be separate authentication targets. If the web application performs redirection to a different port number of protocol, cURL will allow such redirection and will pass credentials. It could also leak the TLS SRP credentials this way.

By default, curl only allows redirects to HTTP(S) and FTP(S), but can be asked to allow redirects to all protocols curl supports.

cURL
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
Amazon Linux AMI
Gentoo Linux
Debian Linux
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
PowerSC
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Oracle Linux
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems)
Slackware Linux
Ubuntu
openEuler
Fedora
cflinuxfs3
Telemetry Dashboard
Liquidware
IBM supplied MQ Advanced container images
Citrix Workspace App
Webex App VDI
IBM Cloud Pak for Watson AIOps
Platform Automation Toolkit
IBM Engineering Requirements Management DOORS Next
Dell Data Protection Central
Dell PowerProtect Cyber Recovery
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
Data Lakehouse
IBM MQ Operator
IBM Spectrum Copy Data Management
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
IBM Rational ClearCase
IBM QRadar WinCollect Agent
Netcool Operations Insight
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Cloud Transformation Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Spectrum Protect Plus
Red Hat OpenStack
IBM Robotic Process Automation
Migration Toolkit for Containers
VMware Horizon Client
HPE Moonshot 1500 Chassis Manager
IBM Aspera High-Speed Transfer Endpoint
Red Hat OpenShift Container Platform
Red Hat Ceph Storage
Splunk Universal Forwarder
IBM Aspera High-Speed Transfer Server
Splunk Enterprise
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libcurl3-nss (Ubuntu package)
curl (Ubuntu package)
libcurl4 (Ubuntu package)
libcurl3-gnutls (Ubuntu package)
curl
libcurl-minimal
libcurl-devel
libcurl
curl (Red Hat package)
curl-help
curl-debugsource
curl-debuginfo
curl (Debian package)
net-misc/curl
libcurl4-debuginfo-32bit
libcurl4-32bit
libcurl4-debuginfo
libcurl4
IBM Security Verify Access
Cisco Jabber
Cisco Webex Meetings
Red Hat OpenShift Serverless
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
RecoverPoint for VMs

Install updates from vendor's website.

cURL - update to 7.83.0
cflinuxfs3 - update to 0.291.0
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.0.1
Data Lakehouse - update to 1.1.0.0
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
IBM MQ Operator - addressed in versions 1.3.6, 2.0.1
Migration Toolkit for Containers - update to 1.7.3
Cloud Pak for Security (CP4S) - update to 1.10.7.0
IBM Spectrum Copy Data Management - update to 2.2.17
Red Hat Advanced Cluster Management for Kubernetes - update to 2.5.1
Red Hat Advanced Cluster Security for Kubernetes - update to 3.71
OpenShift Logging - addressed in versions 5.2.13, 5.3.10, 5.4.3
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
IBM Rational ClearCase - addressed in versions 9.0.1.14, 9.0.2.6, 9.1.0.3
Splunk Universal Forwarder - addressed in versions 8.1.14, 8.2.11, 9.0.5
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
IBM supplied MQ Advanced container images - addressed in versions 9.2.0.6-r1, 9.3.0.0-r2
IBM QRadar WinCollect Agent - update to 10.0.2
IBM Security Verify Access - update to 10.0.5.0
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
Netcool Operations Insight - update to 1.6.7
Red Hat OpenShift Serverless - update to 1.24.0
Isolation Segment - addressed in versions 2.7.45, 2.10.25, 2.11.14, 2.12.8
VMware Tanzu Application Service for VMs - addressed in versions 2.7.50, 2.10.32, 2.11.20, 2.12.13, 2.13.5
IBM Cloud Transformation Advisor - update to 3.10.0
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
IBM Cloud Pak for Watson AIOps - update to 4.1.1
IBM Aspera High-Speed Transfer Server - update to 4.4.1
IBM Aspera High-Speed Transfer Endpoint - update to 4.4.1
Platform Automation Toolkit - addressed in versions 4.4.29, 5.0.22
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.6.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.11.0
OpenShift Virtualization - update to 4.11.0
Red Hat OpenShift Container Platform - update to 4.11.0
RecoverPoint for VMs - update to 6.0.SP1.P1
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 8, 7.5.0 Update Pack 4
libcurl3-nss (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.17, 7.68.0-1ubuntu2.10, 7.74.0-1.3ubuntu2.1, 7.81.0-1ubuntu1.1
curl (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.17, 7.68.0-1ubuntu2.10, 7.74.0-1.3ubuntu2.1, 7.81.0-1ubuntu1.1
libcurl4 (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.17, 7.68.0-1ubuntu2.10, 7.74.0-1.3ubuntu2.1, 7.81.0-1ubuntu1.1
libcurl3-gnutls (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.17, 7.68.0-1ubuntu2.10, 7.74.0-1.3ubuntu2.1, 7.81.0-1ubuntu1.1
curl - addressed in versions 7.61.1-12.101, 7.87.0-2
libcurl-minimal - update to 7.61.1-22
libcurl-devel - update to 7.61.1-22
libcurl - update to 7.61.1-22
curl - update to 7.61.1-22
curl (Red Hat package) - update to 7.61.1-22.el8_6.3
curl-help - update to 7.71.1-13
libcurl-devel - update to 7.71.1-13
libcurl - update to 7.71.1-13
curl-debugsource - update to 7.71.1-13
curl-debuginfo - update to 7.71.1-13
curl - update to 7.71.1-13
curl (Debian package) - addressed in versions 7.74.0-1.3+deb11u2, 7.74.0-1.3+deb11u5, 7.74.0-1.3+deb11u7
curl - addressed in versions 7.76.1-15.fc34, 7.76.1-16.fc34, 7.79.1-3.fc35, 7.79.1-4.fc35, 7.82.0-4.fc36
net-misc/curl - update to 7.86.0
libcurl4-debuginfo-32bit - update to 8.0.1-11.65.2
curl-debugsource - update to 8.0.1-11.65.2
libcurl4-32bit - update to 8.0.1-11.65.2
libcurl-devel - update to 8.0.1-11.65.2
libcurl4-debuginfo - update to 8.0.1-11.65.2
libcurl4 - update to 8.0.1-11.65.2
curl - update to 8.0.1-11.65.2
curl-debuginfo - update to 8.0.1-11.65.2
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7
IBM Spectrum Protect Plus - update to 10.1.12
Red Hat OpenStack - update to 16.2.z
Dell Data Protection Central - update to 19.9
Dell PowerProtect Cyber Recovery - update to 19.14.0.1
IBM Robotic Process Automation - update to 21.0.3

• https://curl.haxx.se/docs/CVE-2022-27774.html

• Multiple vulnerabilities in cURL
• Slackware Linux update for curl
• Multiple vulnerabilities in Cflinuxfs3
• Ubuntu update for curl
• Multiple vulnerabilities in IBM QRadar WinCollect Agent
• Red Hat Enterprise Linux 8.6 update for curl
• Red Hat Enterprise Linux 9 update for curl
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.5
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.4
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenStack 16.2
• Multiple vulnerabilities in IBM Rational ClearCase
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes
• Debian update for curl
• Multiple vulnerabilities in Secondary Scheduler Operator for Red Hat OpenShift
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Openshift Logging 5.3
• Multiple vulnerabilities in Openshift Logging 5.2
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in Red Hat Ceph Storage 5.2
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Virtualization
• Multiple vulnerabilities in IBM PowerSC
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• Amazon Linux AMI update for curl
• Gentoo update for curl
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Security Verify Access
• Debian update for curl
• Multiple vulnerabilities in IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint
• Multiple vulnerabilities in IIBM QRadar SIEM
• Debian update for curl
• SUSE update for curl
• VMware Tanzu products update for curl
• Splunk Universal Forwarder update for third-party packages
• Information disclosure in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in Dell Data Protection Central
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• openEuler update for curl
• Multiple vulnerabilities in Dell ThinOS
• Multiple vulnerabilities in Dell Data Lakehouse System Software
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Amazon Linux AMI update for curl
• Multiple vulnerabilities in HPE Moonshot 1500 Chassis Manager
• Fedora 34 update for curl
• Fedora 35 update for curl
• Fedora 36 update for curl
• Fedora 34 update for curl
• Fedora 35 update for curl
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Anolis OS update for curl