Lucene search

K

HackeroneCVELIST:CVE-2022-35252

HistorySep 23, 2022 - 12:00 a.m.

CVE-2022-35252

2022-09-2300:00:00

CWE-20

hackerone

www.cve.org

9

curl

vulnerability

cookies

denial of service

http server

AI Score

5

Confidence

High

EPSS

0.001

Percentile

50.8%

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/curl/curl",
    "versions": [
      {
        "version": "Fixed in curl 7.85.0",
        "status": "affected"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2023/Jan/20

seclists.org/fulldisclosure/2023/Jan/21

hackerone.com/reports/1613943

lists.debian.org/debian-lts-announce/2023/01/msg00028.html

security.gentoo.org/glsa/202212-01

security.netapp.com/advisory/ntap-20220930-0005/

support.apple.com/kb/HT213603

support.apple.com/kb/HT213604

AI Score

5

Confidence

High

EPSS

0.001

Percentile

50.8%

Related for CVELIST:CVE-2022-35252