PT-2022-2589 · Curl+8 · Curl+8

Harry Sintonen + 1 · Published 2022-04-21 · Updated 2026-05-18 · CVE-2022-27775

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions curl versions 7.65.0 through 7.82.0

Description The issue is related to the implementation of the configuration matching function in the curl utility, which does not properly handle IPv6 address zone IDs. This can lead to incorrect connections being made when one transfer uses a zone ID and a subsequent transfer uses a different (or no) zone ID. The vulnerability allows a remote attacker to potentially reuse a connection, leading to information disclosure.

Recommendations For curl versions 7.65.0 through 7.82.0, update to a version that fixes the issue with the configuration matching function to prevent incorrect connections and potential information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-399

CWE-200

Related Identifiers

ALSA-2022:8299

ALT-PU-2022-1827

ALT-PU-2022-1877

ALT-PU-2022-1902

BDU:2022-03038

CLEANSTART-2026-AY18527

CLEANSTART-2026-BW46578

CLEANSTART-2026-DI23929

CLEANSTART-2026-LQ42192

CLEANSTART-2026-OF85770

CVE-2022-27775

DSA-5197-1

MGASA-2022-0159

OESA-2022-1659

OPENSUSE-SU-2022_1657-1

OPENSUSE-SU-2024:12028-1

RHSA-2022:8299

RHSA-2022_8299

RLSA-2022:8299

SUSE-SU-2022:1657-1

SUSE-SU-2022_1657-1

USN-5397-1

Affected Products

Alt Linux

Almalinux

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Curl

References · 318

• 🔥 https://hackerone.com/reports/1546268 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28321 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27779 · Security Note
• https://advisories.mageia.org/MGASA-2022-0159.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-7264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0500 · Security Note
• https://osv.dev/vulnerability/ALSA-2022:8299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27781 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-27534 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22924 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12028-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-27775 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-8169 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22925 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000257 · Security Note