Incorrect default permissions in cURL - CVE-2022-32207

Vulnerability identifier: #VU64684

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-32207

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect default permissions set to cookies, alt-svc and hsts data stored in local files. A local user with ability to read such files can gain access to potentially sensitive information.

cURL
Amazon Linux AMI
Gentoo Linux
PowerSC
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Oracle Solaris
Slackware Linux
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
openSUSE Leap
Ubuntu
openEuler
Fedora
My Cloud OS 5
macOS
My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud
SINAMICS GL150
SINAMICS SL150
SINAMICS PERFECT HARMONY GH180 6SR5
RUGGEDCOM ROX RX1501
RUGGEDCOM ROX MX5000
RUGGEDCOM ROX RX5000
RUGGEDCOM ROX RX1536
RUGGEDCOM ROX RX1400
RUGGEDCOM ROX RX1524
RUGGEDCOM ROX MX5000RE
RUGGEDCOM ROX RX1510
RUGGEDCOM ROX RX1500
RUGGEDCOM ROX RX1511
RUGGEDCOM ROX RX1512
SCALANCE S615
PowerScale OneFS
Dell Data Protection Central
Dell EMC PowerProtect Data Protection
cflinuxfs3
Telemetry Dashboard
Liquidware
Citrix Workspace App
Webex App VDI
Platform Automation Toolkit
Watson Studio on Cloud Pak for Data
IBM Engineering Requirements Management DOORS Next
Data Lakehouse
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Cloud Transformation Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
EasyApache
IBM Rational ClearCase
IBM QRadar WinCollect Agent
IBM Spectrum Protect Plus
JBoss Core Services
MySQL Enterprise Backup
VMware Horizon Client
Splunk Universal Forwarder
Splunk Enterprise
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-openssl-chil (Red Hat package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-nghttp2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
libcurl3-gnutls (Ubuntu package)
libcurl3-nss (Ubuntu package)
libcurl4 (Ubuntu package)
curl (Ubuntu package)
curl
curl-help
curl-debugsource
curl-debuginfo
libcurl-devel
libcurl
curl (Debian package)
curl (Red Hat package)
libcurl4
libcurl4-debuginfo
libcurl-devel-32bit
libcurl4-32bit
libcurl4-32bit-debuginfo
net-misc/curl
jbcs-httpd24-curl (Red Hat package)
Cisco Jabber
Cisco Webex Meetings
SCALANCE XCM332
RUGGEDCOM RM1224 LTE(4G) EU
SCALANCE M876-4
SCALANCE M876-4 (EU)
SCALANCE M876-3 (ROK)
SCALANCE M876-4 (NAM)
SCALANCE MUM853-1 (EU)
SCALANCE MUM856-1 (EU)
SCALANCE M876-3 (EVDO)
SCALANCE MUM856-1 (RoW)
SCALANCE S615 EEC
SCALANCE M874-3
SCALANCE M874-2
SCALANCE M826-2 SHDSL-Router
SCALANCE M816-1 ADSL-Router (Annex B)
SCALANCE M812-1 ADSL-Router (Annex B)
SCALANCE M812-1 ADSL-Router (Annex A)
SCALANCE M804PB
RUGGEDCOM RM1224 LTE(4G) NAM
SCALANCE M816-1 ADSL-Router (Annex A)

Install updates from vendor's website.

cURL - update to 7.84.0
cflinuxfs3 - update to 0.308.0
Data Lakehouse - update to 1.1.0.0
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
JBoss Core Services - update to 2.4.51 SP1
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
Splunk Universal Forwarder - addressed in versions 8.1.14, 8.2.11, 9.0.5
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
jbcs-httpd24-openssl-pkcs11 (Red Hat package) - addressed in versions 0.4.10-32.el7jbcs, 0.4.10-32.el8jbcs
jbcs-httpd24-openssl-chil (Red Hat package) - addressed in versions 1.0.0-17.el7jbcs, 1.0.0-17.el8jbcs
jbcs-httpd24-mod_proxy_cluster (Red Hat package) - addressed in versions 1.3.17-13.el7jbcs, 1.3.17-13.el8jbcs
jbcs-httpd24-apr-util (Red Hat package) - addressed in versions 1.6.1-99.el7jbcs, 1.6.1-99.el8jbcs
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.19-20.el7jbcs, 1.15.19-20.el8jbcs
jbcs-httpd24-nghttp2 (Red Hat package) - addressed in versions 1.43.0-11.el7jbcs, 1.43.0-11.el8jbcs
SCALANCE XCM332 - update to 2.2
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.4.0-18.el7jbcs, 2.4.0-18.el8jbcs
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.51-37.el7jbcs, 2.4.51-37.el8jbcs
Isolation Segment - addressed in versions 2.7.47, 2.10.27, 2.11.16, 2.12.11
VMware Tanzu Application Service for VMs - addressed in versions 2.7.52, 2.10.34, 2.11.22, 2.12.16, 2.13.7
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.3-22.el7jbcs, 2.9.3-22.el8jbcs
RUGGEDCOM ROX RX1501 - update to 2.16.0
RUGGEDCOM ROX MX5000 - update to 2.16.0
RUGGEDCOM ROX RX5000 - update to 2.16.0
RUGGEDCOM ROX RX1536 - update to 2.16.0
RUGGEDCOM ROX RX1400 - update to 2.16.0
RUGGEDCOM ROX RX1524 - update to 2.16.0
RUGGEDCOM ROX MX5000RE - update to 2.16.0
RUGGEDCOM ROX RX1510 - update to 2.16.0
RUGGEDCOM ROX RX1500 - update to 2.16.0
RUGGEDCOM ROX RX1511 - update to 2.16.0
RUGGEDCOM ROX RX1512 - update to 2.16.0
IBM Cloud Transformation Advisor - update to 3.10.0
Platform Automation Toolkit - addressed in versions 4.4.29, 5.0.22
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.4
EasyApache - update to 4 2022-6-29
Watson Studio on Cloud Pak for Data - update to 5.0.3
My Cloud OS 5 - update to 5.25.124
RUGGEDCOM RM1224 LTE(4G) EU - update to 7.2
SCALANCE M876-4 - update to 7.2
SCALANCE M876-4 (EU) - update to 7.2
SCALANCE M876-3 (ROK) - update to 7.2
SCALANCE M876-4 (NAM) - update to 7.2
SCALANCE MUM853-1 (EU) - update to 7.2
SCALANCE MUM856-1 (EU) - update to 7.2
SCALANCE M876-3 (EVDO) - update to 7.2
SCALANCE MUM856-1 (RoW) - update to 7.2
SCALANCE S615 - update to 7.2
SCALANCE S615 EEC - update to 7.2
SCALANCE M874-3 - update to 7.2
SCALANCE M874-2 - update to 7.2
SCALANCE M826-2 SHDSL-Router - update to 7.2
SCALANCE M816-1 ADSL-Router (Annex B) - update to 7.2
SCALANCE M812-1 ADSL-Router (Annex B) - update to 7.2
SCALANCE M812-1 ADSL-Router (Annex A) - update to 7.2
SCALANCE M804PB - update to 7.2
RUGGEDCOM RM1224 LTE(4G) NAM - update to 7.2
SCALANCE M816-1 ADSL-Router (Annex A) - update to 7.2
libcurl3-gnutls (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.19, 7.68.0-1ubuntu2.12, 7.74.0-1.3ubuntu2.3, 7.81.0-1ubuntu1.3
libcurl3-nss (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.19, 7.68.0-1ubuntu2.12, 7.74.0-1.3ubuntu2.3, 7.81.0-1ubuntu1.3
libcurl4 (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.19, 7.68.0-1ubuntu2.12, 7.74.0-1.3ubuntu2.3, 7.81.0-1ubuntu1.3
curl (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.19, 7.68.0-1ubuntu2.12, 7.74.0-1.3ubuntu2.3, 7.81.0-1ubuntu1.3, 7.81.0-1ubuntu1.21
curl - update to 7.71.1-15
curl-help - update to 7.71.1-15
curl-debugsource - update to 7.71.1-15
curl-debuginfo - update to 7.71.1-15
libcurl-devel - update to 7.71.1-15
libcurl - update to 7.71.1-15
curl (Debian package) - update to 7.74.0-1.3+deb11u2
curl (Red Hat package) - update to 7.76.1-14.el9_0.5
curl - addressed in versions 7.79.1-5.fc35, 7.82.0-6.fc36
curl-debugsource - update to 7.79.1-150400.5.3.1
libcurl-devel - update to 7.79.1-150400.5.3.1
libcurl4 - update to 7.79.1-150400.5.3.1
curl-debuginfo - update to 7.79.1-150400.5.3.1
curl - update to 7.79.1-150400.5.3.1
libcurl4-debuginfo - update to 7.79.1-150400.5.3.1
libcurl-devel-32bit - update to 7.79.1-150400.5.3.1
libcurl4-32bit - update to 7.79.1-150400.5.3.1
libcurl4-32bit-debuginfo - update to 7.79.1-150400.5.3.1
net-misc/curl - update to 7.86.0
jbcs-httpd24-curl (Red Hat package) - addressed in versions 7.86.0-2.el7jbcs, 7.86.0-2.el8jbcs
curl - update to 7.87.0-2
IBM Rational ClearCase - addressed in versions 9.0.2.7, 9.1.0.4, 10.0.0.1
PowerScale OneFS - addressed in versions 9.1.0.26, 9.2.1.19, 9.4.0.10
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7
IBM QRadar WinCollect Agent - update to 10.1.1
IBM Spectrum Protect Plus - update to 10.1.12
macOS - update to 13.0 22A380

• https://curl.haxx.se/docs/CVE-2022-32207.html

• Multiple vulnerabilities in cURL
• Ubuntu update for curl
• Multiple vulnerabilities in cflinuxfs3
• Slackware Linux update for curl
• Multiple vulnerabilities in cPanel EasyApache
• SUSE update for curl
• Debian update for curl
• Red Hat Enterprise Linux 9 update for curl
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in MySQL Enterprise Backup
• Multiple vulnerabilities in Apple macOS Ventura
• Multiple vulnerabilities in Western Digital My Cloud OS 5
• Red Hat JBoss Core Services update for Apache HTTP Server
• Multiple vulnerabilities in IBM QRadar Wincollect agent
• Gentoo update for curl
• Multiple vulnerabilities in Dell PowerScale OneFS
• Multiple vulnerabilities in IBM PowerSC
• Multiple vulnerabilities in IBM Rational ClearCase
• Multiple vulnerabilities in Siemens RUGGEDCOM and SCALANCE Products
• Multiple vulnerabilities in Oracle Solaris
• Multiple vulnerabilities in Siemens SCALANCE XCM332
• VMware Tanzu products update for curl
• Splunk Universal Forwarder update for third-party packages
• Multiple vulnerabilities in Siemens Integrated SCALANCE S615 of SINAMICS Medium Voltage products
• Multiple vulnerabilities in Siemens RUGGEDCOM ROX devices
• Multiple vulnerabilities in Dell Data Protection Central
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• openEuler update for curl
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Dell ThinOS
• Multiple vulnerabilities in Dell Data Lakehouse System Software
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Amazon Linux AMI update for curl
• Fedora 35 update for curl
• Fedora 36 update for curl
• Multiple vulnerabilities in IBM Watson Studio on Cloud Pak for Data - Execution Engine for Apache Hadoop
• Ubuntu update for curl