Vulnerability · Published Jun 1, 2022 · Assigned by hackerone
CVE-2022-30115
Medium 4.3
In plain English
A medium-severity security flaw in https://github.com/curl/curl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | curl | 7.83.1-r0 | ALPINE-CVE-2022-30115 |
| Alpine:v3.21 | curl | 7.83.1-r0 | ALPINE-CVE-2022-30115 |
| Alpine:v3.22 | curl | 7.83.1-r0 | ALPINE-CVE-2022-30115 |
| Alpine:v3.23 | curl | 7.83.1-r0 | ALPINE-CVE-2022-30115 |
| Alpine:v3.24 | curl | 7.83.1-r0 | ALPINE-CVE-2022-30115 |
| Debian:12 | curl | 7.83.1-1 | DEBIAN-CVE-2022-30115 |
| Debian:13 | curl | 7.83.1-1 | DEBIAN-CVE-2022-30115 |
| Debian:14 | curl | 7.83.1-1 | DEBIAN-CVE-2022-30115 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/curl/curl | Fixed in 7.83.1 |
Weakness: CWE-325
References
- https://hackerone.com/reports/1557449
- https://security.netapp.com/advisory/ntap-20220609-0009/
- [oss-security] 20221026 [SECURITY ADVISORY] CVE-2022-42916: HSTS bypass via IDN (curl) mailing-list
- GLSA-202212-01 vendor-advisory
- [oss-security] 20221221 curl: CVE-2022-43551: Another HSTS bypass via IDN mailing-list
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html