Atomic Rename Permissions Widen Vulnerability in curl
Summary
CVE-2022-32207: When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation... Affects curl across 2 version ranges.
< 7.79.1-r2
>= b8d1366852fd0034374c5de1e4968c7a224f77cc, < 45ac4d019475df03562fe0ac54eb67e1d1de0ca7
Fixed in 7.79.1-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
curl is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. The vulnerability affects versions of curl prior to 7.84.0. This vulnerability allows unauthorized users to access updated files that contain saved cookies, alt-svc, and hsts data. The issue arises when curl widens the permissions for the target file during the atomic rename operation, making the updated file accessible to unintended users.
Vulnerability Detail
The Atomic Rename Permissions Widen Vulnerability in curl (CVE-2022-32207) occurs when curl saves cookies, alt-svc, and hsts data to local files. During the finalization of this operation, curl mistakenly widens the permissions for the target file, granting access to more users than intended. This vulnerability can lead to unauthorized access to sensitive information, potentially compromising the security and integrity of the system.
How To Fix
Minimum fixed version
7.79.1-r2
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update curl to the fixed version to address the issue effectively.
Conclusion
The Atomic Rename Permissions Widen Vulnerability in curl (CVE-2022-32207) poses a significant risk to systems running affected versions of curl. It is crucial to update curl to version 7.84.0 or later to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
curl is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more.
Versions of curl prior to 7.84.0 are affected by this vulnerability.
This vulnerability allows unauthorized users to access updated files that contain saved cookies, alt-svc, and hsts data, potentially compromising the security and integrity of the system.
No, there is no known workaround for this vulnerability. It is crucial to update curl to the fixed version.
To fix this vulnerability, update curl to version 7.84.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
