Input validation error in cURL - CVE-2022-27780

Vulnerability identifier: #VU63007

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-27780

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass filters and checks.

The vulnerability exists due to the curl URL parser wrongly accepts percent-encoded URL separators like '/' when decoding the host name part of a URL, making it a different URL using the wrong host name when it is later retrieved. For example, the URL like http://example.com%2F10.0.0.1/, would be allowed by the parser and get transposed into http://example.com/10.0.0.1/.

A remote attacker can bypass various internal filters and checks and force the curl to connect to a wrong web application.

cURL
Amazon Linux AMI
Gentoo Linux
PowerSC
Slackware Linux
Ubuntu
Fedora
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
cflinuxfs3
Platform Automation Toolkit
IBM Engineering Requirements Management DOORS Next
IBM Rational ClearCase
IBM MQ
Isolation Segment
VMware Tanzu Application Service for VMs
Splunk Universal Forwarder
Splunk Enterprise
HPE Moonshot 1500 Chassis Manager
curl (Ubuntu package)
libcurl4 (Ubuntu package)
libcurl3-nss (Ubuntu package)
libcurl3-gnutls (Ubuntu package)
curl
net-misc/curl
PowerScale OneFS

Install updates from vendor's website.

cURL - update to 7.83.1
cflinuxfs3 - update to 0.296.0
IBM Rational ClearCase - addressed in versions 9.0.1.14, 9.0.2.6, 9.1.0.3
Splunk Universal Forwarder - addressed in versions 8.1.14, 8.2.11, 9.0.5
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
Isolation Segment - addressed in versions 2.7.45, 2.10.25, 2.11.14, 2.12.8
VMware Tanzu Application Service for VMs - addressed in versions 2.7.50, 2.10.32, 2.11.20, 2.12.13, 2.13.5
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
Platform Automation Toolkit - addressed in versions 4.4.29, 5.0.22
curl (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.18, 7.68.0-1ubuntu2.11, 7.74.0-1.3ubuntu2.2, 7.81.0-1ubuntu1.2
libcurl4 (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.18, 7.68.0-1ubuntu2.11, 7.74.0-1.3ubuntu2.2, 7.81.0-1ubuntu1.2
libcurl3-nss (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.18, 7.68.0-1ubuntu2.11, 7.74.0-1.3ubuntu2.2, 7.81.0-1ubuntu1.2
libcurl3-gnutls (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.18, 7.68.0-1ubuntu2.11, 7.74.0-1.3ubuntu2.2, 7.81.0-1ubuntu1.2
curl - update to 7.82.0-5.fc36
net-misc/curl - update to 7.86.0
curl - update to 7.87.0-2
PowerScale OneFS - addressed in versions 9.1.0.26, 9.2.1.19, 9.4.0.10
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7

• https://curl.haxx.se/docs/CVE-2022-27780.html

• Multiple vulnerabilities in cURL
• Ubuntu update for curl
• Slackware Linux update for curl
• Multiple vulnerabilities in cflinuxfs3
• Multiple vulnerabilities in IBM Rational ClearCase
• Multiple vulnerabilities in IBM MQ
• Multiple vulnerabilities in IBM PowerSC
• Gentoo update for curl
• Multiple vulnerabilities in Dell PowerScale OneFS
• VMware Tanzu products update for curl
• Splunk Universal Forwarder update for third-party packages
• Multiple vulnerabilities in Dell Data Protection Central
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Amazon Linux AMI update for curl
• Multiple vulnerabilities in HPE Moonshot 1500 Chassis Manager
• Fedora 36 update for curl