Vulnerability · Published Dec 5, 2022 · Assigned by hackerone

CVE-2022-35260

Medium 6.5

In plain English

A medium-severity out-of-bounds read in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium

Exploit odds (30 days)2.7%top 14.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	curl	7.86.0-r0	ALPINE-CVE-2022-35260
Alpine:v3.21	curl	7.86.0-r0	ALPINE-CVE-2022-35260
Alpine:v3.22	curl	7.86.0-r0	ALPINE-CVE-2022-35260
Alpine:v3.23	curl	7.86.0-r0	ALPINE-CVE-2022-35260
Alpine:v3.24	curl	7.86.0-r0	ALPINE-CVE-2022-35260
Debian:12	curl	7.86.0-1	DEBIAN-CVE-2022-35260
Debian:13	curl	7.86.0-1	DEBIAN-CVE-2022-35260
Debian:14	curl	7.86.0-1	DEBIAN-CVE-2022-35260

Affected products (as reported)

Vendor	Product	Versions
n/a	https://github.com/curl/curl	Fixed in 7.86.0

Weakness: CWE-125

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References