Lucene search
Ubuntu.comUB:CVE-2022-32208HistoryJun 27, 2022 - 12:00 a.m.
CVE-2022-32208
2022-06-2700:00:00
ubuntu.com
ubuntu.com
41
cve-2022-32208
ftp
transfer
krb5
message verification
man-in-the-middle
attack
injection
curl
vulnerability
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.003
Percentile
69.5%
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message
verification failures wrongly. This flaw makes it possible for a
Man-In-The-Middle attack to go unnoticed and even allows it to inject data
to the client.
Notes
| Author | Note |
|---|---|
| mdeslaur | introduced in 7.16.4 |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | curl | < 7.58.0-2ubuntu3.19 | UNKNOWN |
| ubuntu | 20.04 | noarch | curl | < 7.68.0-1ubuntu2.12 | UNKNOWN |
| ubuntu | 21.10 | noarch | curl | < 7.74.0-1.3ubuntu2.3 | UNKNOWN |
| ubuntu | 22.04 | noarch | curl | < 7.81.0-1ubuntu1.3 | UNKNOWN |
| ubuntu | 22.10 | noarch | curl | < 7.84.0-1 | UNKNOWN |
| ubuntu | 14.04 | noarch | curl | < 7.35.0-1ubuntu2.20+esm11 | UNKNOWN |
| ubuntu | 16.04 | noarch | curl | < 7.47.0-1ubuntu2.19+esm4 | UNKNOWN |
Related
hackerone
hackerone
Internet Bug Bounty: CVE-2022-32208: FTP-KRB bad message verification
2022-06-27 07:11:13
curl: CVE-2022-32208: FTP-KRB bad message verification
2022-06-02 20:12:35
cbl_mariner
cbl_mariner
CVE-2022-32208 affecting package curl for versions less than 7.84.0-1
2022-08-03 21:15:00
CVE-2022-32208 affecting package curl 7.76.0-9
2022-08-24 22:05:05
veracode
veracode
Man-in-the-Middle (MitM)
2022-06-29 00:04:59
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2022:2356-1)
2022-07-12 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:2327-1)
2022-07-08 00:00:00
openSUSE: Security Advisory for curl (SUSE-SU-2022:2327-2)
2024-03-04 00:00:00
nessus
nessus
CBL Mariner 2.0 Security Update: curl (CVE-2022-32208)
2023-03-20 00:00:00
Siemens SCALANCE XCM332 Out-of-Bounds Write (CVE-2022-32208)
2023-05-02 00:00:00
SUSE SLES12 Security Update : curl (SUSE-SU-2022:2356-1)
2022-07-12 00:00:00
redhatcve
redhatcve
CVE-2022-32208
2022-06-28 03:35:50
osv
osv
CVE-2022-32208
2022-07-07 13:15:08
Moderate: curl security update
2022-08-24 00:00:00
curl vulnerabilities
2022-07-01 02:04:04
debiancve
debiancve
CVE-2022-32208
2022-07-07 13:15:08
nvd
nvd
CVE-2022-32208
2022-07-07 13:15:08
cve
cve
CVE-2022-32208
2022-07-07 13:15:08
cvelist
cvelist
CVE-2022-32208
2022-07-07 00:00:00
alpinelinux
alpinelinux
CVE-2022-32208
2022-07-07 13:15:08
ibm
ibm
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a man-in-the-middle attack in cURL libcurl (CVE-2022-32208)
2023-03-31 16:58:32
prion
prion
Code injection
2022-07-07 13:15:00
ubuntu
ubuntu
curl vulnerabilities
2022-07-01 00:00:00
curl vulnerabilities
2022-06-27 00:00:00
almalinux
almalinux
Moderate: curl security update
2022-08-24 00:00:00
Moderate: curl security update
2022-08-24 00:00:00
rocky
rocky
curl security update
2022-08-24 15:12:40
curl security update
2022-08-24 14:56:48
suse
suse
Security update for curl (important)
2022-07-07 00:00:00
Security update for curl (important)
2022-09-01 00:00:00
Security update for curl (important)
2022-07-06 00:00:00
redhat
redhat
(RHSA-2022:6159) Moderate: curl security update
2022-08-24 15:12:40
(RHSA-2022:6157) Moderate: curl security update
2022-08-24 14:56:48
oraclelinux
oraclelinux
curl security update
2022-08-24 00:00:00
curl security update
2022-08-25 00:00:00
fedora
fedora
[SECURITY] Fedora 36 Update: curl-7.82.0-6.fc36
2022-07-01 01:09:59
[SECURITY] Fedora 35 Update: curl-7.79.1-5.fc35
2022-07-15 01:36:25
slackware
slackware
[slackware-security] curl
2022-06-28 19:27:52
cloudfoundry
cloudfoundry
USN-5495-1: curl vulnerabilities | Cloud Foundry
2022-12-07 00:00:00
mageia
mageia
Updated curl packages fix security vulnerability
2022-07-05 22:11:26
freebsd
freebsd
cURL -- Multiple vulnerabilities
2022-06-27 00:00:00
photon
photon
Moderate Photon OS Security Update - PHSA-2022-0412
2022-06-30 00:00:00
Critical Photon OS Security Update - PHSA-2022-3.0-0412
2022-06-30 00:00:00
Moderate Photon OS Security Update - PHSA-2022-0491
2022-06-30 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2023-2220
2023-08-22 13:18:19
amazon
amazon
Medium: curl
2022-10-31 19:40:00
Medium: curl
2022-12-01 17:33:00
debian
debian
[SECURITY] [DLA 3085-1] curl security update
2022-08-28 23:00:51
[SECURITY] [DSA 5197-1] curl security update
2022-08-01 16:58:44
ics
ics
Siemens SCALANCE XCM332
2023-04-13 12:00:00
Siemens SINAMICS Medium Voltage Products
2023-06-15 12:00:00
Siemens SCALANCE, RUGGEDCOM Third-Party
2023-03-16 12:00:00
gentoo
gentoo
curl: Multiple Vulnerabilities
2022-12-19 00:00:00
apple
apple
About the security content of macOS Ventura 13
2022-10-24 00:00:00
tenable
tenable
[R1] Nessus Network Monitor 6.2.2 Fixes Multiple Vulnerabilities
2023-06-29 10:45:47
oracle
oracle
Oracle Critical Patch Update Advisory - October 2022
2022-10-18 00:00:00
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.003
Percentile
69.5%
Related for UB:CVE-2022-32208