CVE-2022-42915

moderate-risk

Published 2022-10-29

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.

Do I need to act?

0.47% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / HIGH complexity

Affected Products (12)

Curl

Fedora

H300S Firmware

H500S Firmware

H700S Firmware

H410S Firmware

Ontap 9

Macos

Universal Forwarder

Affected Vendors

Apple Haxx Fedoraproject Netapp Splunk

References (20)

Mailing List http://seclists.org/fulldisclosure/2023/Jan/19

Mailing List http://seclists.org/fulldisclosure/2023/Jan/20

Vendor Advisory https://curl.se/docs/CVE-2022-42915.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202212-01

Third Party Advisory https://security.netapp.com/advisory/ntap-20221209-0010/

Third Party Advisory https://support.apple.com/kb/HT213604

Third Party Advisory https://support.apple.com/kb/HT213605

Mailing List http://seclists.org/fulldisclosure/2023/Jan/19

Mailing List http://seclists.org/fulldisclosure/2023/Jan/20

Vendor Advisory https://curl.se/docs/CVE-2022-42915.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202212-01

Third Party Advisory https://security.netapp.com/advisory/ntap-20221209-0010/

Third Party Advisory https://support.apple.com/kb/HT213604

Third Party Advisory https://support.apple.com/kb/HT213605

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 2/34 · Minimal

Exposure 17/34 · Moderate