CVE-2022-32221: Infoleak

Published Oct 17, 2022
·
Updated

A vulnerability was found in curl. The issue occurs when doing HTTP(S) transfers, where curl might erroneously use the read callback (CURLOPTREADFUNCTION) to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set if it previously used the same handle to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent POST request.

Other sources

curl. Multiple issues were addressed by updating to curl version 7.86.0.

— Apple

when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPTREADFUNCTION) to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent POST request.

Reference:

https://curl.se/docs/CVE-2022-32221.html

— Red Hat

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPTREADFUNCTION) to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent POST request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

Credit

CVE-2022-42915, CVE-2022-42916, CVE-2022-32221, CVE-2022-35260

Affected Software

33 affected componentsFixes available
redhat/jbcs-httpd24-curl<0:7.86.0-2.el8
0:7.86.0-2.el8
redhat/jbcs-httpd24-curl<0:7.86.0-2.el7
0:7.86.0-2.el7
redhat/curl<0:7.76.1-19.el9_1.1
0:7.76.1-19.el9_1.1
redhat/curl<0:7.76.1-14.el9_0.6
0:7.76.1-14.el9_0.6
debian/curl<=7.64.0-4+deb10u2
7.64.0-4+deb10u77.74.0-1.3+deb11u97.74.0-1.3+deb11u107.88.1-10+deb12u37.88.1-10+deb12u48.4.0-2
redhat/curl<7.86.0
7.86.0
redhat/libcurl<7.86.0
7.86.0
Apple macOS Monterey<12.6.3
12.6.3
Apple macOS Ventura<13.2
13.2
haxx curl<7.86.0
NetApp Clustered Data ONTAP
All of the following
NetApp H300s Firmware
NetApp H300s
All of the following
NetApp H500s Firmware
NetApp H500s
All of the following
NetApp H700s Firmware
NetApp H700s
All of the following
NetApp H410s Firmware
NetApp H410s
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Apple macOS<12.6.3
Splunk Universal Forwarder>=8.2.0<8.2.12
Splunk Universal Forwarder>=9.0.0<9.0.6
Splunk Universal Forwarder=9.1.0
NetApp H300s Firmware
NetApp H300s
NetApp H500s Firmware
NetApp H500s
NetApp H700s Firmware
NetApp H700s
NetApp H410s Firmware
NetApp H410s

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/jbcs-httpd24-curl to a version that resolves this vulnerability.

    Fixed in 0:7.86.0-2.el8
  2. Upgrade

    Upgrade redhat/jbcs-httpd24-curl to a version that resolves this vulnerability.

    Fixed in 0:7.86.0-2.el7
  3. Upgrade

    Upgrade redhat/curl to a version that resolves this vulnerability.

    Fixed in 0:7.76.1-19.el9_1.1
  4. Upgrade

    Upgrade redhat/curl to a version that resolves this vulnerability.

    Fixed in 0:7.76.1-14.el9_0.6
  5. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 7.64.0-4+deb10u7Fixed in 7.74.0-1.3+deb11u9Fixed in 7.74.0-1.3+deb11u10Fixed in 7.88.1-10+deb12u3Fixed in 7.88.1-10+deb12u4Fixed in 8.4.0-2
  6. Upgrade

    Upgrade redhat/curl to a version that resolves this vulnerability.

    Fixed in 7.86.0
  7. Upgrade

    Upgrade redhat/libcurl to a version that resolves this vulnerability.

    Fixed in 7.86.0
  8. Upgrade

    Upgrade macOS to a version that resolves this vulnerability.

    Fixed in 12.6.3
  9. Upgrade

    Upgrade macOS Ventura to a version that resolves this vulnerability.

    Fixed in 13.2
  10. Upgrade

    Upgrade curl to a version that resolves this vulnerability.

    Fixed in 7.86.0

Event History

Oct 26, 2022
CVE Published
12:00 AM
Dec 5, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is CVE-2022-32221?

CVE-2022-32221 is a vulnerability in libcurl that can be exploited when using the read callback incorrectly.

2

How does CVE-2022-32221 affect macOS Monterey?

macOS Monterey version 12.6.3 is affected by CVE-2022-32221. Updating to version 12.6.3 remedies the vulnerability.

3

Which version of jbcs-httpd24-curl is affected by CVE-2022-32221 on Red Hat?

Versions up to and excluding 0:7.86.0-2.el8 and 0:7.86.0-2.el7 of jbcs-httpd24-curl on Red Hat are affected by CVE-2022-32221.

4

How severe is CVE-2022-32221?

CVE-2022-32221 has a severity level of medium.

5

Where can I find more information about CVE-2022-32221?

You can find more information about CVE-2022-32221 at the following links: [Apple Support](https://support.apple.com/en-us/HT213604), [CVE](https://www.cve.org/CVERecord?id=CVE-2022-32221), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-32221), [curl.se](https://curl.se/docs/CVE-2022-32221.html), and [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2135411).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203