Log in Start free

Vulnerability · Published Jul 7, 2022 · Assigned by hackerone

CVE-2022-32207

Critical 9.8

In plain English

A critical-severity security flaw in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 12.3% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)12.3%top 3.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9curl7.76.1-14.el9_0.5ALSA-2022:6157
AlmaLinux:9curl-minimal7.76.1-14.el9_0.5ALSA-2022:6157
AlmaLinux:9libcurl7.76.1-14.el9_0.5ALSA-2022:6157
AlmaLinux:9libcurl-devel7.76.1-14.el9_0.5ALSA-2022:6157
AlmaLinux:9libcurl-minimal7.76.1-14.el9_0.5ALSA-2022:6157
Alpine:v3.20curl7.84.0-r0ALPINE-CVE-2022-32207
Alpine:v3.21curl7.84.0-r0ALPINE-CVE-2022-32207
Alpine:v3.22curl7.84.0-r0ALPINE-CVE-2022-32207
Alpine:v3.23curl7.84.0-r0ALPINE-CVE-2022-32207
Alpine:v3.24curl7.84.0-r0ALPINE-CVE-2022-32207
Debian:12curl7.84.0-1DEBIAN-CVE-2022-32207
Debian:13curl7.84.0-1DEBIAN-CVE-2022-32207
Debian:14curl7.84.0-1DEBIAN-CVE-2022-32207
Rocky Linux:9curl0:7.76.1-14.el9_0.5RLSA-2022:6157
Ubuntu:22.04:LTScurl7.81.0-1ubuntu1.3UBUNTU-CVE-2022-32207
Ubuntu:22.04:LTScurl7.81.0-1ubuntu1.3USN-5495-1

Affected products (as reported)

VendorProductVersions
n/a https://github.com/curl/curl Fixed in 7.84.0

Weakness: CWE-840 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References