CVE-2022-32206

תיאור (מקור, אנגלית)

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

מדדים

CVSS 3.1

6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS — סבירות ניצול

36% (אחוזון 100) נכון ל-19/10/2026

CWE

CWE-770

מוצרים מושפעים

haxx: curl; fedoraproject: fedora; debian: debian linux; netapp: clustered data ontap; netapp: element software; netapp: hci management node; netapp: solidfire; netapp: hci compute node; netapp: bootstrap os; netapp: h300s; netapp: h300s firmware; netapp: h500s; netapp: h500s firmware; netapp: h700s; netapp: h700s firmware

קישורים

• https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf PatchThird Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf PatchThird Party Advisory
• https://hackerone.com/reports/1570651 ExploitThird Party Advisory
• https://hackerone.com/reports/1570651 ExploitThird Party Advisory
• http://seclists.org/fulldisclosure/2022/Oct/28 Mailing ListThird Party Advisory
• http://seclists.org/fulldisclosure/2022/Oct/41 Mailing ListThird Party Advisory
• http://www.openwall.com/lists/oss-security/2023/02/15/3 Mailing ListThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html Mailing ListThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap‮… Mailing ListThird Party Advisory
• https://security.gentoo.org/glsa/202212-01 Third Party Advisory