6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
58.6%
curl < 7.84.0 supports “chained” HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable “links” in this “decompression chain” was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a “malloc bomb”, makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
CPE | Name | Operator | Version |
---|---|---|---|
curl | eq | 7.26.0-r0 | |
curl | eq | curl-7_12_2 | |
curl | eq | 7.35.0-r0 | |
curl | eq | curl-7_15_3 | |
curl | eq | curl-7_9_8 | |
curl | eq | 7.34.0-r0 | |
curl | eq | 7.81.0-r1 | |
curl | eq | curl-7_32_0 | |
curl | eq | curl-7_21_5 | |
curl | eq | 7.71.0-r0 |
seclists.org/fulldisclosure/2022/Oct/28
seclists.org/fulldisclosure/2022/Oct/41
www.openwall.com/lists/oss-security/2023/02/15/3
cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
hackerone.com/reports/1570651
lists.debian.org/debian-lts-announce/2022/08/msg00017.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
security.gentoo.org/glsa/202212-01
security.netapp.com/advisory/ntap-20220915-0003/
support.apple.com/kb/HT213488
www.debian.org/security/2022/dsa-5197
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
58.6%