Critical Credentials Leak in Curl Package: CVE-2022-27776
Summary
ALPINE-CVE-2022-27776: A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number. Affects curl versions < 7.79.1-r1. Fixed in 7.79.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more. Curl is known for its versatility and is often utilized in scripts and applications for data transfer. However, it has been identified that certain versions of Curl are vulnerable to a credentials leak, which can expose sensitive authentication data during HTTP redirects.
Vulnerability Detail
The vulnerability identified as CVE-2022-27776 arises from insufficient protection of credentials in Curl versions prior to 7.83.0. When a redirect occurs to the same host but on a different port, Curl may inadvertently leak authentication or cookie header data. This could lead to unauthorized access or exposure of sensitive information, posing a significant risk to users and applications relying on Curl for secure data transfers.
How To Fix
Minimum fixed version
7.79.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Curl for requests that involve redirects to different ports until they can update to the patched version. Alternatively, consider using other tools that do not exhibit this vulnerability.
Conclusion
CVE-2022-27776 represents a significant risk for users of Curl, particularly in scenarios involving HTTP redirects. It is crucial to update to the latest version to mitigate the risk of credential leakage. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for curl →
FAQ
CVE-2022-27776 is a vulnerability in Curl that can lead to the leakage of authentication or cookie header data during HTTP redirects.
Curl versions prior to 7.83.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2022-27776 is 6.5, indicating a medium severity level.
If immediate updates are not possible, avoid using Curl for requests that involve redirects to different ports as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
