In curl before 7.86.0 the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion e.g. using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.

🗓️ 09 Nov 2022 08:00:00Reported by MicrosoftType

Curl HSTS bypass could force HTTPS via IDN ASCII swap, earliest 7.77.0 and earlier.

Reporter	Title	Published	Views	Family All 132
FreeBSD	curl -- multiple vulnerabilities	26 Oct 202200:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libcURL affect IBM Rational ClearCase ( CVE-2022-42915, CVE-2022-42916, CVE-2022-32221, CVE-2022-35252, CVE-2022-32205, CVE-2022-32206, CVE-2022-32207 )	31 Jan 202314:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	14 Mar 202316:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect agent is vulnerable to using components with know vulnerabilities	5 Dec 202219:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7	24 Oct 202411:46	–	ibm
IBM Security Bulletins	Security Bulletin: The Community Edition of IBM ILOG CPLEX Optimization Studio is affected by multiple vulnerabilities in libcurl (CVE-2022-42915, CVE-2022-42916, CVE-2022-32221)	17 Nov 202208:48	–	ibm
Tenable Nessus	Amazon Linux 2022 : curl (ALAS2022-2022-246)	9 Dec 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-083)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : curl (ALAS-2022-1882)	7 Dec 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP11 : curl (EulerOS-SA-2023-1005)	5 Jan 202300:00	–	nessus