CVE-2022-27780

🗓️ 01 Jun 2022 00:00:00Reported by Debian Security Bug TrackerType

debiancve🔗 security-tracker.debian.org👁 62 Views

The curl URL parser wrongly accepts percent-encoded URL separators like '/' when decoding the host name part of a URL, leading to the use of the wrong host name in the retrieved URL

Reporter	Title	Published	Views	Family All 84
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	23 Sep 202222:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in libcURL affect IBM Rational ClearCase ( CVE-2022-27778, CVE-2022-27779, CVE-2022-27780, CVE-2022-27782, CVE-2022-30115, CVE-2022-27774 )	25 Jul 202214:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent and Base Module use libcurl with multiple known vulnerabilities	6 Oct 202204:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is vulnerable to issues with libcurl (CVE-2022-27780, CVE-2022-30115)	25 Aug 202215:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7	24 Oct 202411:46	–	ibm
FreeBSD	curl -- Multiple vulnerabilities	11 May 202200:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 10 package curl version 7.83.1-alt1	19 May 202200:00	–	altlinux
ATTACKERKB	CVE-2022-27780	2 Jun 202214:15	–	attackerkb
Tenable Nessus	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-065)	6 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-206)	4 Nov 202200:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	12	all	curl	7.83.1-1	curl_7.83.1-1_all.deb
Debian	13	all	curl	7.83.1-1	curl_7.83.1-1_all.deb
Debian	14	all	curl	7.83.1-1	curl_7.83.1-1_all.deb
Debian	999	all	curl	7.83.1-1	curl_7.83.1-1_all.deb

01 Jun 2022 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 25

CVSS 3.15.3 - 7.5

EPSS0.02334

SSVC