libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

🗓️ 15 Jun 2022 07:00:00Reported by MicrosoftType

Curl may set and send cookies for top level domains when the host ends with a dot; public suffix list affects this bug.

Reporter	Title	Published	Views	Family All 74
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	23 Sep 202222:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in libcURL affect IBM Rational ClearCase ( CVE-2022-27778, CVE-2022-27779, CVE-2022-27780, CVE-2022-27782, CVE-2022-30115, CVE-2022-27774 )	25 Jul 202214:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent and Base Module use libcurl with multiple known vulnerabilities	6 Oct 202204:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7	24 Oct 202411:46	–	ibm
FreeBSD	curl -- Multiple vulnerabilities	11 May 202200:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 10 package curl version 7.83.1-alt1	19 May 202200:00	–	altlinux
ATTACKERKB	CVE-2022-27779	2 Jun 202214:15	–	attackerkb
Tenable Nessus	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-065)	6 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-206)	4 Nov 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-083)	21 Mar 202300:00	–	nessus