CVE-2022-27780

Name
CVE-2022-27780
Description
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://hackerone.com/reports/1553841
CONFIRM https://security.netapp.com/advisory/ntap-20220609-0009/
vendor-advisory https://security.gentoo.org/glsa/202212-01

Match rules

CPE URI Source package Min version Max version
https://github.com/curl/curl == Fixed in 7.83.1 == Fixed in 7.83.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
curl edge-main 7.83.1-r0 None fixed
curl 3.22-main 7.83.1-r0 None fixed
curl 3.21-main 7.83.1-r0 None fixed
curl 3.20-main 7.83.1-r0 None fixed
curl 3.19-main 7.83.1-r0 None fixed
curl 3.18-main 7.83.1-r0 None fixed
curl 3.17-main 7.83.1-r0 None fixed