CVE-2022-27776: Medium severity haxx curl vulnerability
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.64.0-4+deb10u7Fixed in 7.74.0-1.3+deb11u9Fixed in 7.74.0-1.3+deb11u10Fixed in 7.88.1-10+deb12u3Fixed in 7.88.1-10+deb12u4Fixed in 8.4.0-2 - Upgrade
Upgrade
curlto a version that resolves this vulnerability.Fixed in 7.83.0
Event History
Frequently Asked Questions
What is CVE-2022-27776?
CVE-2022-27776 refers to an insufficiently protected credentials vulnerability in curl 7.83.0.
What is the severity of CVE-2022-27776?
The severity of CVE-2022-27776 is high (6.5).
How does CVE-2022-27776 impact users?
CVE-2022-27776 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
Which software versions are affected by CVE-2022-27776?
The vulnerable software versions include curl 7.64.0-4+deb10u7, 7.74.0-1.3+deb11u9, 7.74.0-1.3+deb11u10, 7.88.1-10+deb12u3, 7.88.1-10+deb12u4, and 8.4.0-2.
Where can I find more information about CVE-2022-27776?
You can find more information about CVE-2022-27776 at the following references: [link1], [link2], [link3].