CVE-2022-22576: High severity haxx curl vulnerability
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S) IMAP(S) POP3(S) and LDAP(S) (openldap only).
Other sources
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).
libcurl might reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u5Fixed in 8.14.1-2+deb13u7Fixed in 8.22.0-1Fixed in 8.23.0-1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 7.79.1-r1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 7.80.0-r1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 7.83.0-r0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.83.0-1 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.83.0
Event History
Frequently Asked Questions
What is CVE-2022-22576?
CVE-2022-22576 is an improper authentication vulnerability in curl, versions 7.33.0 to 7.82.0, which allows reuse of OAuth2-authenticated connections without proper authentication.
How does CVE-2022-22576 affect SASL-enabled protocols?
CVE-2022-22576 affects SASL-enabled protocols by allowing reuse of OAuth2-authenticated connections without proper authentication.
Which software versions are affected by CVE-2022-22576?
Versions 7.33.0 to 7.82.0 of curl are affected by CVE-2022-22576, as well as certain versions of Debian Linux, NetApp Clustered Data ONTAP, NetApp Solidfire, Brocade Fabric Operating System, and NetApp Bootstrap OS.
What is the severity of CVE-2022-22576?
CVE-2022-22576 has a severity rating of 8.1 (high).
How can I fix CVE-2022-22576?
To fix CVE-2022-22576, update curl to version 7.83.0 or later.