CVE-2022-42915
published 2022-10-29CVE-2022-42915: curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote…
PriorityP350high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
2.93%
85.3th percentile
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | >= 12.0.0 < 12.6.3 | 12.6.3 |
| apple | macos | >= 13.0 < 13.2 | 13.2 |
| apple | macos_monterey | — | — |
| apple | macos_ventura | — | — |
| debian | curl | < curl 7.86.0-1 (bookworm) | curl 7.86.0-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| haxx | curl | >= 0 < 7.86.0-1 | 7.86.0-1 |
| haxx | curl | >= 0 < 7.86.0-1 | 7.86.0-1 |
| haxx | curl | >= 0 < 7.86.0-1 | 7.86.0-1 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.21 | 7.58.0-2ubuntu3.21 |
| haxx | curl | >= 0 < 7.68.0-1ubuntu2.14 | 7.68.0-1ubuntu2.14 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.6 | 7.81.0-1ubuntu1.6 |
| haxx | curl | >= 7.77.0 < 7.86.0 | 7.86.0 |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.11.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_curl_7.86.0-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_tensorflow_2.11.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
vendor_redhat8.1HIGH
vendor_oracle7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC NMS Third-Party
cisa_ics·2023-05-11·CVSS 9.8
[CRITICAL] Siemens SINEC NMS Third-Party
ICS Advisory
##
Siemens SINEC NMS Third-Party
Release DateMay 11, 2023
Alert CodeICSA-23-131-05
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Third-party components libexpat and libcurl in SINEC NMS
- Vulnerabilities: Expected Behavior Violation, Improper Validation of Syntactic Correctness of Input, Stack-based Buffer Overflow, Use After Free, Double Free, Cleartext Tran
Apple
CVE-2022-42915: macOS Ventura 13.2
vendor_apple·2023-01-23·CVSS 8.1
CVE-2022-42915 [HIGH] CVE-2022-42915: macOS Ventura 13.2
Apple Security Update: About the security content of macOS Ventura 13.2
Product: macOS Ventura
Version: 13.2
CVE: CVE-2022-42915
Component: CVE-2022-42915
Apple
CVE-2022-42915: macOS Monterey 12.6.3
vendor_apple·2023-01-23·CVSS 8.1
CVE-2022-42915 [HIGH] CVE-2022-42915: macOS Monterey 12.6.3
Apple Security Update: About the security content of macOS Monterey 12.6.3
Product: macOS Monterey
Version: 12.6.3
CVE: CVE-2022-42915
Component: CVE-2022-42915
Oracle
Oracle Oracle Essbase Risk Matrix: Infrastructure (cURL) — CVE-2022-42915
vendor_oracle·2023-01-15·CVSS 7.2
CVE-2022-42915 [HIGH] Oracle Oracle Essbase Risk Matrix: Infrastructure (cURL) — CVE-2022-42915
Oracle Oracle Essbase Risk Matrix: Infrastructure (cURL) vulnerability
CVE: CVE-2022-42915
CVSS: 7.2
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2023 (JAN 2023)
Red Hat
curl: HTTP proxy double-free
vendor_redhat·2022-10-26·CVSS 8.1
CVE-2022-42915 [HIGH] CWE-415 curl: HTTP proxy double-free
curl: HTTP proxy double-free
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
A vulnerability was found in curl. The issue occurs if curl is
Ubuntu
curl vulnerabilities
vendor_ubuntu·2022-10-26·CVSS 9.8
CVE-2022-32221 [CRITICAL] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Robby Simpson discovered that curl incorrectly handled certain POST
operations after PUT operations. This issue could cause applications using
curl to send the wrong data, perform incorrect memory operations, or crash.
(CVE-2022-32221)
Hiroki Kurosawa discovered that curl incorrectly handled parsing .netrc
files. If an attacker were able to provide a specially crafted .netrc file,
this issue could cause curl to crash, resulting in a denial of service.
This issue only affected Ubuntu 22.10. (CVE-2022-35260)
It was discovered that curl incorrectly handled certain HTTP proxy return
codes. A remote attacker could use this issue to cause curl to crash,
resulting in a denial of service, or possibly execute arbit
Microsoft
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL it sets up the connection to the remote server by issuing a CONNECT request to the prox
vendor_msrc·2022-10-11·CVSS 8.1
CVE-2022-42915 [HIGH] CWE-415 curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL it sets up the connection to the remote server by issuing a CONNECT request to the prox
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL it sets up the connection to the remote server by issuing a CONNECT request to the proxy and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict gopher gophers ldap ldaps rtmp rtmps or telnet. The earliest affected version is 7.77.0.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore p
Debian
CVE-2022-42915: curl - curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a...
vendor_debian·2022·CVSS 8.1
CVE-2022-42915 [HIGH] CVE-2022-42915: curl - curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a...
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
Scope: local
bookworm: resolved (fixed in 7.86.0-1)
bullseye: resolved
forky: resolved (fixed
GHSA
GHSA-98w6-hw73-ph8m: curl before 7
ghsa_unreviewed·2022-10-30
CVE-2022-42915 [CRITICAL] CWE-415 GHSA-98w6-hw73-ph8m: curl before 7
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
OSV
CVE-2022-42915: curl before 7
osv·2022-10-29·CVSS 8.1
CVE-2022-42915 [HIGH] CVE-2022-42915: curl before 7
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
OSV
curl vulnerabilities
osv·2022-10-26·CVSS 9.8
CVE-2022-32221 [CRITICAL] curl vulnerabilities
curl vulnerabilities
Robby Simpson discovered that curl incorrectly handled certain POST
operations after PUT operations. This issue could cause applications using
curl to send the wrong data, perform incorrect memory operations, or crash.
(CVE-2022-32221)
Hiroki Kurosawa discovered that curl incorrectly handled parsing .netrc
files. If an attacker were able to provide a specially crafted .netrc file,
this issue could cause curl to crash, resulting in a denial of service.
This issue only affected Ubuntu 22.10. (CVE-2022-35260)
It was discovered that curl incorrectly handled certain HTTP proxy return
codes. A remote attacker could use this issue to cause curl to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 22.04 LTS, and Ubu
No detection rules found.
No public exploits indexed.
Trailofbits
Securing open-source infrastructure with OSTIF
blogs_trailofbits·2024-01-09
Securing open-source infrastructure with OSTIF
The Open Source Technology Improvement Fund (OSTIF) counters an often overlooked challenge in the open-source world: the same software projects that uphold today’s internet infrastructure are reliant on, in OSTIF’s words, a “surprisingly small group of people with a limited amount of time” for all development, testing, and maintenance.
This scarcity of contributor time in the open-source community is a well-known problem, and it renders the internet’s critical infrastructure vulnerable. To quote OSTIF, “because of the lack of a profit motive, core open-source projects are woefully underfunded and their resources are lacking. This leaves crucial Internet infrastructure susceptible to bugs, poor documentation, poor performance, slow release schedules, and even espionage.”
We couldn’t agree
Trailofbits
Securing open-source infrastructure with OSTIF
blogs_trailofbits·2024-01-09
Securing open-source infrastructure with OSTIF
The Open Source Technology Improvement Fund (OSTIF) counters an often overlooked challenge in the open-source world: the same software projects that uphold today’s internet infrastructure are reliant on, in OSTIF’s words, a “surprisingly small group of people with a limited amount of time” for all development, testing, and maintenance.
This scarcity of contributor time in the open-source community is a well-known problem, and it renders the internet’s critical infrastructure vulnerable. To quote OSTIF, “because of the lack of a profit motive, core open-source projects are woefully underfunded and their resources are lacking. This leaves crucial Internet infrastructure susceptible to bugs, poor documentation, poor performance, slow release schedules, and even espionage.”
We couldn’t agree
Trailofbits
cURL audit: How a joke led to significant findings
blogs_trailofbits·2023-02-14·CVSS 8.1
CVE-2022-42915 [HIGH] cURL audit: How a joke led to significant findings
In fall 2022, Trail of Bits audited cURL, a widely-used command-line utility that transfers data between a server and supports various protocols. The project coincided with a Trail of Bits maker week, which meant that we had more manpower than we usually do, allowing us to take a nonstandard approach to the audit.
curl AAAAAAAAAA…
CVE-2022-42915 – Double free when using HTTP proxy with specific protocols. Fixed in cURL 7.86.0
CVE-2022-43552 – Use-after-free when HTTP proxy denies tunneling SMB/TELNET protocols. Fixed in cURL 7.87.0
TOB-CURL-10 – Use-after-free while using parallel option and sequences. Fixed in cURL 7.86.0
TOB-CURL-11 – Unused memory blocks are not freed, resulting in memory leaks. Fixed in cURL 7.87.0
## Working with cURL
curl-fuzzer
AddressSanitizer
main()
argc
Trailofbits
cURL audit: How a joke led to significant findings
blogs_trailofbits·2023-02-14·CVSS 8.1
[HIGH] cURL audit: How a joke led to significant findings
In fall 2022, Trail of Bits audited cURL, a widely-used command-line utility that transfers data between a server and supports various protocols. The project coincided with a Trail of Bits maker week, which meant that we had more manpower than we usually do, allowing us to take a nonstandard approach to the audit.
While discussing the threat model of the application, one of our team members jokingly asked, “Have we tried `curl AAAAAAAAAA…` yet”? Although the comment was made in jest, it sparked an idea: we should fuzz cURL’s command-line interface (CLI). Once we did so, the fuzzer quickly uncovered memory corruption bugs, specifically use-after-free issues, double-free issues, and memory leaks. Because the bugs are in libcurl, a cURL development library, they have the potential to affect
HackerOne
CVE-2022-42915: HTTP proxy double-free
hackerone·2022-11-26·CVSS 8.1
CVE-2022-42915 [HIGH] CVE-2022-42915: HTTP proxy double-free
CVE-2022-42915: HTTP proxy double-free
This is a finding that Trail of Bits found in their ongoing curl security audit. Reported at a status meeting today.
## Summary:
curl frees memory twice in some cleanup function related to HTTP proxies.
It as simple as `curl -x http://localhost:80 dict://127.0.0.1`
Using valgrind on the current git master, it shows:
==55921== Memcheck, a memory error detector
==55921== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==55921== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info
==55921== Command: ./src/curl -x http://localhost:80 dict://127.0.0.1
==55921== Parent PID: 3035
==55921==
==55921== Invalid free() / delete / delete[] / realloc()
==55921== at 0x484617B: free (vg_replace_malloc.c:872)
==55921== by 0x152464:
http://seclists.org/fulldisclosure/2023/Jan/19http://seclists.org/fulldisclosure/2023/Jan/20https://curl.se/docs/CVE-2022-42915.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/https://security.gentoo.org/glsa/202212-01https://security.netapp.com/advisory/ntap-20221209-0010/https://support.apple.com/kb/HT213604https://support.apple.com/kb/HT213605http://seclists.org/fulldisclosure/2023/Jan/19http://seclists.org/fulldisclosure/2023/Jan/20https://curl.se/docs/CVE-2022-42915.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/https://security.gentoo.org/glsa/202212-01https://security.netapp.com/advisory/ntap-20221209-0010/https://support.apple.com/kb/HT213604https://support.apple.com/kb/HT213605
2022-10-29
Published