Resource exhaustion in cURL - CVE-2022-32206

Vulnerability identifier: #VU64682

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-32206

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insecure processing of compressed HTTP responses. A malicious server can send a specially crafted HTTP response to curl and perform a denial of service attack by forcing curl to spend enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

cURL
Cloud Pak for Security (CP4S)
Cloud Pak for Data
SINAMICS PERFECT HARMONY GH180 6SR5
SINAMICS GL150
SINAMICS SL150
SCALANCE S615
PowerScale OneFS
Amazon Linux AMI
Gentoo Linux
PowerSC
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
IBM AIX
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Oracle Solaris
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
openEuler
Fedora
My Cloud OS 5
macOS
My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud
cflinuxfs3
Telemetry Dashboard
Liquidware
Citrix Workspace App
Webex App VDI
ObjectScale
IBM Cloud Pak for Watson AIOps
EMC ECS
Platform Automation Toolkit
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Watson Studio on Cloud Pak for Data
IBM Engineering Requirements Management DOORS Next
Dell Data Protection Central
Submariner
Gatekeeper Operator
Data Lakehouse
IBM MQ Operator
Service Telemetry Framework
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
Oracle Communications Cloud Native Core Network Exposure Function
Netcool Operations Insight
Red Hat OpenShift distributed tracing (RHOSDT)
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Cloud Transformation Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
EasyApache
IBM Rational ClearCase
IBM QRadar WinCollect Agent
IBM Spectrum Protect Plus
IBM Robotic Process Automation
OpenShift API for Data Protection (OADP)
OpenShift sandboxed containers
Multicluster Engine for Kubernetes
OpenShift Virtualization
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
VMware Horizon Client
JBoss Core Services
Splunk Universal Forwarder
Splunk Enterprise
Dell EMC NetWorker vProxy
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-openssl-chil (Red Hat package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-nghttp2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
libcurl4 (Ubuntu package)
curl (Ubuntu package)
libcurl3-nss (Ubuntu package)
libcurl3-gnutls (Ubuntu package)
libcurl4-debuginfo-32bit
curl
curl-debuginfo
curl-debugsource
libcurl4
libcurl4-32bit
libcurl4-debuginfo
libcurl4-32bit-debuginfo
libcurl-devel
curl (Red Hat package)
libcurl-minimal
libcurl
libcurl-devel-32bit
curl-help
curl (Debian package)
net-misc/curl
jbcs-httpd24-curl (Red Hat package)
IBM Security Verify Access
Cisco Jabber
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Unified Data Repository
Cisco Webex Meetings
SCALANCE XCM332
SCALANCE SC646-2C
SCALANCE SC626-2C
SCALANCE SC622-2C
SCALANCE SC632-2C
SCALANCE SC636-2C
SCALANCE SC642-2C
SCALANCE M876-4 (NAM)
SCALANCE M876-3 (EVDO)
SCALANCE M876-3 (ROK)
SCALANCE M876-4
SCALANCE M876-4 (EU)
RUGGEDCOM RM1224 LTE(4G) NAM
SCALANCE MUM853-1 (EU)
SCALANCE MUM856-1 (EU)
SCALANCE MUM856-1 (RoW)
SCALANCE S615 EEC
SCALANCE M874-3
SCALANCE M874-2
SCALANCE M826-2 SHDSL-Router
SCALANCE M816-1 ADSL-Router (Annex B)
SCALANCE M816-1 ADSL-Router (Annex A)
SCALANCE M812-1 ADSL-Router (Annex B)
SCALANCE M812-1 ADSL-Router (Annex A)
SCALANCE M804PB
RUGGEDCOM RM1224 LTE(4G) EU
Dell EMC VxRail Appliance

Install updates from vendor's website.

cURL - update to 7.84.0
cflinuxfs3 - update to 0.308.0
Submariner - update to 0.13.0
Gatekeeper Operator - update to 0.2
OpenShift API for Data Protection (OADP) - addressed in versions 1.0.4, 1.1.0
OpenShift sandboxed containers - update to 1.3.1
Data Lakehouse - update to 1.1.0.0
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
IBM MQ Operator - addressed in versions 1.3.8, 2.0.3
Service Telemetry Framework - update to 1.5.2
Migration Toolkit for Containers - update to 1.7.4
Multicluster Engine for Kubernetes - addressed in versions 2.0.2, 2.1
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.3.12, 2.4.6, 2.5.2, 2.6.0
JBoss Core Services - update to 2.4.51 SP1
Red Hat Advanced Cluster Security for Kubernetes - update to 3.72
Red Hat OpenShift Container Platform - update to 4.11.3
OpenShift Logging - addressed in versions 5.3.11, 5.3.12, 5.4.5, 5.5.1
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
Splunk Universal Forwarder - addressed in versions 8.1.14, 8.2.11, 9.0.5
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
IBM Security Verify Access - update to 10.0.5.0
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
jbcs-httpd24-openssl-pkcs11 (Red Hat package) - addressed in versions 0.4.10-32.el7jbcs, 0.4.10-32.el8jbcs
jbcs-httpd24-openssl-chil (Red Hat package) - addressed in versions 1.0.0-17.el7jbcs, 1.0.0-17.el8jbcs
jbcs-httpd24-mod_proxy_cluster (Red Hat package) - addressed in versions 1.3.17-13.el7jbcs, 1.3.17-13.el8jbcs
ObjectScale - update to 1.4.0
jbcs-httpd24-apr-util (Red Hat package) - addressed in versions 1.6.1-99.el7jbcs, 1.6.1-99.el8jbcs
Netcool Operations Insight - update to 1.6.7
Cloud Pak for Security (CP4S) - update to 1.10.12.0
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.19-20.el7jbcs, 1.15.19-20.el8jbcs
jbcs-httpd24-nghttp2 (Red Hat package) - addressed in versions 1.43.0-11.el7jbcs, 1.43.0-11.el8jbcs
SCALANCE XCM332 - update to 2.2
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.4.0-18.el7jbcs, 2.4.0-18.el8jbcs
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.51-37.el7jbcs, 2.4.51-37.el8jbcs
Red Hat OpenShift distributed tracing (RHOSDT) - update to 2.6.0
Isolation Segment - addressed in versions 2.7.47, 2.10.27, 2.11.16, 2.12.11
VMware Tanzu Application Service for VMs - addressed in versions 2.7.52, 2.10.34, 2.11.22, 2.12.16, 2.13.7
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.3-22.el7jbcs, 2.9.3-22.el8jbcs
SCALANCE SC646-2C - update to 3.0
SCALANCE SC626-2C - update to 3.0
SCALANCE SC622-2C - update to 3.0
SCALANCE SC632-2C - update to 3.0
SCALANCE SC636-2C - update to 3.0
SCALANCE SC642-2C - update to 3.0
IBM Cloud Pak for Watson AIOps - update to 3.6.1
EMC ECS - update to 3.8.0.2
IBM Cloud Transformation Advisor - update to 3.10.0
Dell EMC NetWorker vProxy - update to 4.3.0-34
Platform Automation Toolkit - addressed in versions 4.4.29, 5.0.22
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.6.4
DB2 Warehouse on Cloud Pak for Data - update to 4.8.2
DB2 on Cloud Pak for Data - update to 4.8.2
OpenShift Virtualization - addressed in versions 4.11.1, 4.12.0
EasyApache - update to 4 2022-6-29
Cloud Pak for Data - update to 5.0.0
Watson Studio on Cloud Pak for Data - update to 5.0.3
My Cloud OS 5 - update to 5.25.124
SCALANCE M876-4 (NAM) - update to 7.2
SCALANCE M876-3 (EVDO) - update to 7.2
SCALANCE M876-3 (ROK) - update to 7.2
SCALANCE M876-4 - update to 7.2
SCALANCE M876-4 (EU) - update to 7.2
RUGGEDCOM RM1224 LTE(4G) NAM - update to 7.2
SCALANCE MUM853-1 (EU) - update to 7.2
SCALANCE MUM856-1 (EU) - update to 7.2
SCALANCE MUM856-1 (RoW) - update to 7.2
SCALANCE S615 - update to 7.2
SCALANCE S615 EEC - update to 7.2
SCALANCE M874-3 - update to 7.2
SCALANCE M874-2 - update to 7.2
SCALANCE M826-2 SHDSL-Router - update to 7.2
SCALANCE M816-1 ADSL-Router (Annex B) - update to 7.2
SCALANCE M816-1 ADSL-Router (Annex A) - update to 7.2
SCALANCE M812-1 ADSL-Router (Annex B) - update to 7.2
SCALANCE M812-1 ADSL-Router (Annex A) - update to 7.2
SCALANCE M804PB - update to 7.2
RUGGEDCOM RM1224 LTE(4G) EU - update to 7.2
libcurl4 (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.19, 7.68.0-1ubuntu2.12, 7.74.0-1.3ubuntu2.3, 7.81.0-1ubuntu1.3
curl (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.19, 7.68.0-1ubuntu2.12, 7.74.0-1.3ubuntu2.3, 7.81.0-1ubuntu1.3, 7.81.0-1ubuntu1.21
libcurl3-nss (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.19, 7.68.0-1ubuntu2.12, 7.74.0-1.3ubuntu2.3, 7.81.0-1ubuntu1.3
libcurl3-gnutls (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.19, 7.68.0-1ubuntu2.12, 7.74.0-1.3ubuntu2.3, 7.81.0-1ubuntu1.3
libcurl4-debuginfo-32bit - update to 7.60.0-4.38.1
curl - addressed in versions 7.60.0-4.38.1, 7.60.0-150000.33.1, 7.66.0-150200.4.36.1, 7.79.1-150400.5.3.1
curl-debuginfo - addressed in versions 7.60.0-4.38.1, 7.60.0-150000.33.1, 7.66.0-150200.4.36.1, 7.79.1-150400.5.3.1
curl-debugsource - addressed in versions 7.60.0-4.38.1, 7.60.0-150000.33.1, 7.66.0-150200.4.36.1, 7.79.1-150400.5.3.1
libcurl4 - addressed in versions 7.60.0-4.38.1, 7.60.0-150000.33.1, 7.66.0-150200.4.36.1, 7.79.1-150400.5.3.1
libcurl4-32bit - addressed in versions 7.60.0-4.38.1, 7.60.0-150000.33.1, 7.66.0-150200.4.36.1, 7.79.1-150400.5.3.1
libcurl4-debuginfo - addressed in versions 7.60.0-4.38.1, 7.60.0-150000.33.1, 7.66.0-150200.4.36.1, 7.79.1-150400.5.3.1
libcurl4-32bit-debuginfo - addressed in versions 7.60.0-150000.33.1, 7.66.0-150200.4.36.1, 7.79.1-150400.5.3.1
libcurl-devel - addressed in versions 7.60.0-150000.33.1, 7.66.0-150200.4.36.1, 7.79.1-150400.5.3.1
curl - addressed in versions 7.61.1-12.101, 7.87.0-2
curl (Red Hat package) - addressed in versions 7.61.1-18.el8_4.3, 7.61.1-22.el8_6.4, 7.76.1-14.el9_0.5
libcurl-minimal - update to 7.61.1-22
curl - update to 7.61.1-22
libcurl - update to 7.61.1-22
libcurl-devel - update to 7.61.1-22
libcurl-devel-32bit - addressed in versions 7.66.0-150200.4.36.1, 7.79.1-150400.5.3.1
curl - update to 7.71.1-15
curl-help - update to 7.71.1-15
libcurl - update to 7.71.1-15
libcurl-devel - update to 7.71.1-15
curl-debuginfo - update to 7.71.1-15
curl-debugsource - update to 7.71.1-15
curl (Debian package) - update to 7.74.0-1.3+deb11u2
curl - addressed in versions 7.79.1-5.fc35, 7.82.0-6.fc36
net-misc/curl - update to 7.86.0
jbcs-httpd24-curl (Red Hat package) - addressed in versions 7.86.0-2.el7jbcs, 7.86.0-2.el8jbcs
Dell EMC VxRail Appliance - update to 8.0.000
IBM Rational ClearCase - addressed in versions 9.0.2.7, 9.1.0.4, 10.0.0.1
PowerScale OneFS - addressed in versions 9.1.0.26, 9.2.1.19, 9.4.0.10
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7
IBM QRadar WinCollect Agent - update to 10.1.1
IBM Spectrum Protect Plus - update to 10.1.12
macOS - update to 13.0 22A380
Dell Data Protection Central - update to 19.9
IBM Robotic Process Automation - update to 21.0.5

• https://curl.haxx.se/docs/CVE-2022-32206.html

• Multiple vulnerabilities in cURL
• Ubuntu update for curl
• Multiple vulnerabilities in cflinuxfs3
• Slackware Linux update for curl
• Multiple vulnerabilities in cPanel EasyApache
• SUSE update for curl
• SUSE update for curl
• Debian update for curl
• SUSE update for curl
• SUSE update for curl
• Red Hat Enterprise Linux 9 update for curl
• Red Hat Enterprise Linux 8 update for curl
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.3
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP)
• Multiple vulnerabilities in Red Hat Gatekeeper Operator
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.4
• Multiple vulnerabilities in Submariner
• Multiple vulnerabilities in Multicluster Engine for Kubernetes
• Multiple vulnerabilities in Openshift Logging 5.3
• Multiple vulnerabilities in Openshift Logging 5.5
• Multiple vulnerabilities in Red Hat Advanced Cluster Management
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Multicluster Engine for Kubernetes
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.0
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.5
• Multiple vulnerabilities in Dell NetWorker vProxy
• Multiple vulnerabilities in OpenShift Logging 5.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Red Hat OpenShift distributed tracing (RHOSDT)
• Multiple vulnerabilities in OpenShift sandboxed containers
• Multiple vulnerabilities in Apple macOS Ventura
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in OpenShift Virtualization 4.11
• Multiple vulnerabilities in Western Digital My Cloud OS 5
• Red Hat JBoss Core Services update for Apache HTTP Server
• Amazon Linux AMI update for curl
• Multiple vulnerabilities in IBM QRadar Wincollect agent
• Multiple vulnerabilities in Siemens SCALANCE SC-600 Family
• Gentoo update for curl
• Multiple vulnerabilities in Dell PowerScale OneFS
• Multiple vulnerabilities in Dell VxRail Appliance components
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in IBM PowerSC
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in IBM Rational ClearCase
• Multiple vulnerabilities in Siemens RUGGEDCOM and SCALANCE Products
• Multiple vulnerabilities in Oracle Solaris
• Resource exhaustion in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Siemens SCALANCE XCM332
• Multiple vulnerabilities in Dell ECS
• VMware Tanzu products update for curl
• Splunk Universal Forwarder update for third-party packages
• Red Hat Enterprise Linux 8 update for curl
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in Siemens Integrated SCALANCE S615 of SINAMICS Medium Voltage products
• IBM AIX update for cURL
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Oracle Solaris third-party software
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Service Telemetry Framework 1.5
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• openEuler update for curl
• Multiple vulnerabilities in Dell ThinOS
• Multiple vulnerabilities in Dell Data Lakehouse System Software
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Amazon Linux AMI update for curl
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Cloud Pak for Data
• Fedora 35 update for curl
• Fedora 36 update for curl
• Multiple vulnerabilities in IBM Watson Studio on Cloud Pak for Data - Execution Engine for Apache Hadoop
• Anolis OS update for curl
• Ubuntu update for curl