Information Disclosure Vulnerability in Curl Package
Summary
ALPINE-CVE-2022-27775: An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead. Affects curl versions < 7.79.1-r1. Fixed in 7.79.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more. Curl is known for its versatility and is commonly used in scripts, applications, and web services. However, certain versions of Curl are vulnerable to an information disclosure issue that can arise when handling IPv6 addresses in connection pools.
Vulnerability Detail
An information disclosure vulnerability exists in Curl versions 7.65.0 to 7.82.0. This vulnerability allows an attacker to exploit the connection pooling mechanism by using an IPv6 address that is already in the connection pool but with a different zone ID. This could lead to the reuse of a connection, potentially exposing sensitive information. The vulnerability is classified with a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
7.79.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, consider avoiding the use of IPv6 addresses in connection pools until the package is updated. This can help mitigate the risk of information disclosure until a patch is applied.
Conclusion
The information disclosure vulnerability in Curl poses a significant risk to applications using affected versions. It is crucial to update to the latest patched versions to mitigate this risk. Users should also consider using Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for curl →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Curl versions 7.65.0 to 7.82.0 are vulnerable to this information disclosure issue.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
As a temporary measure, avoid using IPv6 addresses in connection pools until you can apply the necessary updates.
Detailed information can be found in the CVE-2022-27775 documentation and the Alpine Linux security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
