CVE-2022-27776: Medium severity curl vulnerability
Published Apr 27, 2022
·Updated
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
Affected Software
34 affected componentsFixes available
debian/curl<=7.64.0-4+deb10u2
7.64.0-4+deb10u77.74.0-1.3+deb11u97.74.0-1.3+deb11u107.88.1-10+deb12u37.88.1-10+deb12u48.4.0-2
debian/curl<=7.74.0-1.3+deb11u1, <=7.64.0-4+deb10u2, <=7.82.0-2
haxx curl<7.83.0
Fedoraproject Fedora=36
Fedoraproject Fedora=37
Debian Debian Linux=10.0
Debian Debian Linux=11.0
All of the following
NetApp Hci Bootstrap Os
NetApp Hci Compute Node
NetApp Clustered Data ONTAP
NetApp Solidfire \& Hci Management Node
NetApp Solidfire \& Hci Storage Node
Brocade Fabric Operating System
All of the following
NetApp H300s Firmware
NetApp H300s
All of the following
NetApp H500s Firmware
NetApp H500s
All of the following
NetApp H700s Firmware
NetApp H700s
All of the following
NetApp H410s Firmware
NetApp H410s
Splunk Universal Forwarder>=8.2.0<8.2.12
Splunk Universal Forwarder>=9.0.0<9.0.6
Splunk Universal Forwarder=9.1.0
NetApp Hci Bootstrap Os
NetApp Hci Compute Node
NetApp H300s Firmware
NetApp H300s
NetApp H500s Firmware
NetApp H500s
NetApp H700s Firmware
NetApp H700s
NetApp H410s Firmware
NetApp H410s
Event History
Jun 1, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2022-27776?
CVE-2022-27776 refers to an insufficiently protected credentials vulnerability in curl 7.83.0.
2
What is the severity of CVE-2022-27776?
The severity of CVE-2022-27776 is high (6.5).
3
How does CVE-2022-27776 impact users?
CVE-2022-27776 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
4
Which software versions are affected by CVE-2022-27776?
The vulnerable software versions include curl 7.64.0-4+deb10u7, 7.74.0-1.3+deb11u9, 7.74.0-1.3+deb11u10, 7.88.1-10+deb12u3, 7.88.1-10+deb12u4, and 8.4.0-2.
5
Where can I find more information about CVE-2022-27776?
You can find more information about CVE-2022-27776 at the following references: [link1], [link2], [link3].