IM
IronMonkey Threat Research

CVE-2022-27775 HIGH

Published: 2022-06-02 | Last Modified: 2026-05-27 | Status: Modified

Description

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.

Additional Descriptions (1)

Se presenta una vulnerabilidad de divulgación de información en curl versiones 7.65.0 a 7.82.0, son vulnerables que al usar una dirección IPv6 que estaba en el pool de conexiones pero con un id de zona diferente podría reusar una conexión en su lugar

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-200
[email protected] Primary
en NVD-CWE-noinfo

Affected Products

Vendor Product Version Update Type
haxx curl * <built-in method update of dict object at 0x7fd369405140> Application
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd319dd6240> Operating System
netapp hci_bootstrap_os - <built-in method update of dict object at 0x7fd34bce3b40> Operating System
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd319dd4800> Application
netapp solidfire_\&_hci_management_node - <built-in method update of dict object at 0x7fd369406140> Application
netapp solidfire_\&_hci_storage_node - <built-in method update of dict object at 0x7fd369406100> Application
brocade fabric_operating_system - <built-in method update of dict object at 0x7fd369407e80> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd34bce0800> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd369404b00> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd3694048c0> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd319dd4bc0> Operating System
splunk universal_forwarder * <built-in method update of dict object at 0x7fd319dd5340> Application
splunk universal_forwarder * <built-in method update of dict object at 0x7fd3845fdbc0> Application
splunk universal_forwarder 9.1.0 <built-in method update of dict object at 0x7fd34bce30c0> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:o:brocade:fabric_operating_system:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

References