CVE-2022-27781

2022-05-1100:00:00

ubuntu.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

55.7%

JSON

libcurl provides the CURLOPT_CERTINFO option to allow applications
torequest details to be returned about a server’s certificate chain.Due to
an erroneous function, a malicious server could make libcurl built withNSS
get stuck in a never-ending busy-loop when trying to retrieve
thatinformation.
Due to an erroneous function, a malicious server could make libcurl built
with NSS get stuck in a never-ending busy-loop when trying to retrieve that
information.]

Notes

Author	Note
alexmurray	Affects curl versions 7.34.0 up to and include 7.83.0

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchcurl< 7.58.0-2ubuntu3.18UNKNOWN
ubuntu20.04noarchcurl< 7.68.0-1ubuntu2.11UNKNOWN
ubuntu21.10noarchcurl< 7.74.0-1.3ubuntu2.2UNKNOWN
ubuntu22.04noarchcurl< 7.81.0-1ubuntu1.2UNKNOWN
ubuntu14.04noarchcurl< 7.35.0-1ubuntu2.20+esm11) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
ubuntu16.04noarchcurl< 7.47.0-1ubuntu2.19+esm4) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	curl	< 7.58.0-2ubuntu3.18	UNKNOWN
ubuntu	20.04	noarch	curl	< 7.68.0-1ubuntu2.11	UNKNOWN
ubuntu	21.10	noarch	curl	< 7.74.0-1.3ubuntu2.2	UNKNOWN
ubuntu	22.04	noarch	curl	< 7.81.0-1ubuntu1.2	UNKNOWN
ubuntu	14.04	noarch	curl	< 7.35.0-1ubuntu2.20+esm11) Available with Ubuntu Pro or Ubuntu Pro (Infra-only	UNKNOWN
ubuntu	16.04	noarch	curl	< 7.47.0-1ubuntu2.19+esm4) Available with Ubuntu Pro or Ubuntu Pro (Infra-only	UNKNOWN