Improper Verification of Cryptographic Signature in cURL - CVE-2022-32208

Vulnerability identifier: #VU64685

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-32208

CWE-ID: CWE-347

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
cURL
Cloud Pak for Security (CP4S)
Cloud Pak for Data
Amazon Linux AMI
Gentoo Linux
PowerSC
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Oracle Solaris
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Slackware Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
openEuler
Fedora
My Cloud OS 5
macOS
My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud
SINAMICS GL150
SINAMICS SL150
SINAMICS PERFECT HARMONY GH180 6SR5
SCALANCE S615
PowerScale OneFS
cflinuxfs3
Telemetry Dashboard
Liquidware
Citrix Workspace App
Webex App VDI
ObjectScale
IBM Cloud Pak for Watson AIOps
EMC ECS
Platform Automation Toolkit
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Watson Studio on Cloud Pak for Data
IBM Engineering Requirements Management DOORS Next
Dell Data Protection Central
Submariner
Gatekeeper Operator
Data Lakehouse
IBM MQ Operator
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
Netcool Operations Insight
Red Hat OpenShift distributed tracing (RHOSDT)
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Cloud Transformation Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
EasyApache
IBM QRadar WinCollect Agent
IBM Spectrum Protect Plus
IBM Robotic Process Automation
OpenShift API for Data Protection (OADP)
OpenShift sandboxed containers
Multicluster Engine for Kubernetes
OpenShift Virtualization
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
VMware Horizon Client
JBoss Core Services
Splunk Universal Forwarder
Splunk Enterprise
Dell EMC NetWorker vProxy
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-openssl-chil (Red Hat package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-nghttp2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
curl
curl-debuginfo
curl-debugsource
libcurl4-32bit
libcurl4
libcurl4-debuginfo-32bit
libcurl4-debuginfo
libcurl3-gnutls (Ubuntu package)
libcurl3-nss (Ubuntu package)
libcurl3 (Ubuntu package)
curl (Ubuntu package)
libcurl4 (Ubuntu package)
libcurl-devel
libcurl4-32bit-debuginfo
libcurl-minimal
libcurl
curl (Red Hat package)
libcurl-devel-32bit
curl-help
curl (Debian package)
net-misc/curl
jbcs-httpd24-curl (Red Hat package)
IBM Security Verify Access
Cisco Jabber
Cisco Webex Meetings
SCALANCE XCM332
SCALANCE M876-3 (ROK)
SCALANCE S615 EEC
SCALANCE M876-4
SCALANCE M876-4 (EU)
SCALANCE M876-4 (NAM)
SCALANCE MUM853-1 (EU)
SCALANCE MUM856-1 (EU)
SCALANCE MUM856-1 (RoW)
SCALANCE M876-3 (EVDO)
SCALANCE M874-3
SCALANCE M874-2
SCALANCE M826-2 SHDSL-Router
SCALANCE M816-1 ADSL-Router (Annex B)
SCALANCE M816-1 ADSL-Router (Annex A)
RUGGEDCOM RM1224 LTE(4G) EU
RUGGEDCOM RM1224 LTE(4G) NAM
SCALANCE M804PB
SCALANCE M812-1 ADSL-Router (Annex A)
SCALANCE M812-1 ADSL-Router (Annex B)
Dell EMC VxRail Appliance

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper handling of message verification failures when performing FTP transfers secured by krb5. A remote attacker can perform MitM attack and manipulate data.

Install updates from vendor's website.

• https://curl.haxx.se/docs/CVE-2022-32208.html