Severity
9.8CRITICAL
EPSS
1.7%
top 17.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 5
Latest updateMay 18

Description

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

CVEListV5https://github.com/curl/curlFixed in 7.86.0
NVDhaxx/curl< 7.86.0
NVDapple/macos< 12.6.3
NVDsplunk/universal_forwarder8.2.08.2.12+2
Debiancurl< 7.74.0-1.3+deb11u5+3

Also affects: Debian Linux 10.0, 11.0

🔴Vulnerability Details

5
GHSA
GHSA-grfr-78m7-q35q: When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT2022-12-06
OSV
CVE-2022-32221: When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT2022-12-05
CVEList
CVE-2022-32221: When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT2022-12-05
OSV
curl vulnerabilities2022-10-26
OSV
curl vulnerability2022-10-26

📋Vendor Advisories

9
Ubuntu
MySQL vulnerabilities2023-01-24
Apple
CVE-2022-32221: macOS Monterey 12.6.32023-01-23
Apple
CVE-2022-32221: macOS Ventura 13.22023-01-23
Oracle
Oracle Oracle MySQL Risk Matrix: Server: Packaging (cURL) — CVE-2022-322212023-01-15
Microsoft
When doing HTTP(S) transfers libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send even when the `CURLOPT_POSTFIELDS` option has been set if the same handle 2022-12-13

💬Community

2
HackerOne
CVE-2023-28322: more POST-after-PUT confusion2023-05-18
HackerOne
CVE-2022-32221: POST following PUT confusion2022-11-26