CVE-2022-30115

תיאור (מקור, אנגלית)

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.

מדדים

CVSS 3.1

4.3 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS — סבירות ניצול

1% (אחוזון 100) נכון ל-15/10/2026

CWE

CWE-325, CWE-319

מוצרים מושפעים

haxx: curl; netapp: hci bootstrap os; netapp: hci compute node; netapp: clustered data ontap; netapp: solidfire\, enterprise sds \& hci storage node; netapp: solidfire \& hci management node; netapp: h300s firmware; netapp: h300s; netapp: h500s firmware; netapp: h500s; netapp: h700s firmware; netapp: h700s; netapp: h410s firmware; netapp: h410s; splunk: universal forwarder

קישורים

• http://www.openwall.com/lists/oss-security/2022/10/26/4 Mailing ListPatchThird Party Advisory
• http://www.openwall.com/lists/oss-security/2022/10/26/4 Mailing ListPatchThird Party Advisory
• https://hackerone.com/reports/1557449 ExploitThird Party Advisory
• https://hackerone.com/reports/1557449 ExploitThird Party Advisory
• http://www.openwall.com/lists/oss-security/2022/12/21/1 Mailing ListThird Party Advisory
• https://security.gentoo.org/glsa/202212-01 Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220609-0009/ Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/12/21/1 Mailing ListThird Party Advisory
• https://security.gentoo.org/glsa/202212-01 Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220609-0009/ Third Party Advisory