CVE-2022-32205
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 27.1%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- EPSS
- 27.08% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- haxx/curl · fedoraproject/fedora · debian/debian linux · netapp/clustered data ontap · netapp/element software · netapp/hci management node · netapp/solidfire · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h410s firmware · apple/macos · siemens/scalance sc622-2c firmware · siemens/scalance sc626-2c firmware · siemens/scalance sc632-2c firmware · siemens/scalance sc636-2c firmware · siemens/scalance sc642-2c firmware · siemens/scalance sc646-2c firmware · splunk/universal forwarder
- Source
- support@hackerone.com
References
- http://seclists.org/fulldisclosure/2022/Oct/28Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/41Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdfPatch, Third Party Advisory
- https://hackerone.com/reports/1569946Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220915-0003/Third Party Advisory
- https://support.apple.com/kb/HT213488Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/28Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/41Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdfPatch, Third Party Advisory
- https://hackerone.com/reports/1569946Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220915-0003/Third Party Advisory
- https://support.apple.com/kb/HT213488Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.