Lucene search

K
osvGoogleOSV:CURL-CVE-2022-35252
HistoryAug 31, 2022 - 8:00 a.m.

control code in cookie denial of service

2022-08-3108:00:00
Google
osv.dev
1

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.9%

When curl retrieves and parses cookies from an HTTP(S) server, it accepts
cookies using control codes (byte values below 32). When cookies that contain
such control codes are later sent back to an HTTP(S) server, it might make the
server return a 400 response. Effectively allowing a “sister site” to deny
service to siblings.

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.9%