IM
IronMonkey Threat Research

CVE-2022-32206 MEDIUM

Published: 2022-07-07 | Last Modified: 2025-05-05 | Status: Modified

Description

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

Additional Descriptions (1)

curl versiones anteriores a 7.84.0, soporta algoritmos de compresión HTTP "encadenados", lo que significa que una respuesta al servidor puede ser comprimida múltiples veces y potencialmente con diferentes algoritmos. El número de "eslabones" aceptables en esta "cadena de descompresión" era ilimitado, lo que permitía a un servidor malicioso insertar un número prácticamente ilimitado de pasos de compresión. El uso de una cadena de descompresión de este tipo podía resultar en una "bomba de malloc", haciendo que curl acabara gastando enormes cantidades de memoria de montón asignada, o intentando y devolviendo errores de memoria

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-770
[email protected] Primary
en CWE-770

Affected Products

Vendor Product Version Update Type
haxx curl * <built-in method update of dict object at 0x7fd340b88b40> Application
fedoraproject fedora 35 <built-in method update of dict object at 0x7fd39c4c9840> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd39c4c8200> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd39c4cb3c0> Operating System
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd39c2f3500> Application
netapp element_software - <built-in method update of dict object at 0x7fd37034b400> Application
netapp hci_management_node - <built-in method update of dict object at 0x7fd39c4cbe80> Application
netapp solidfire - <built-in method update of dict object at 0x7fd39c4c9080> Application
netapp bootstrap_os - <built-in method update of dict object at 0x7fd39c4c80c0> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd370349bc0> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd39c4c8c40> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd39c4c9600> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd39c4c9680> Operating System
siemens scalance_sc622-2c_firmware * <built-in method update of dict object at 0x7fd39c4cad40> Operating System
siemens scalance_sc626-2c_firmware * <built-in method update of dict object at 0x7fd39c4c8640> Operating System
siemens scalance_sc632-2c_firmware * <built-in method update of dict object at 0x7fd39c4ca240> Operating System
siemens scalance_sc636-2c_firmware * <built-in method update of dict object at 0x7fd39c4ca4c0> Operating System
siemens scalance_sc642-2c_firmware * <built-in method update of dict object at 0x7fd39c4c9500> Operating System
siemens scalance_sc646-2c_firmware * <built-in method update of dict object at 0x7fd39c4c9f40> Operating System
splunk universal_forwarder * <built-in method update of dict object at 0x7fd39c4c9140> Application
splunk universal_forwarder * <built-in method update of dict object at 0x7fd369c0cc40> Application
splunk universal_forwarder 9.1.0 <built-in method update of dict object at 0x7fd39c4ca6c0> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_sc622-2c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_sc622-2c_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_sc626-2c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_sc626-2c_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_sc632-2c_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_sc632-2c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_sc636-2c_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_sc636-2c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_sc642-2c_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_sc642-2c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_sc646-2c_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_sc646-2c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

References