Vulnerability Name:

CVE-2022-27781 (CCN-226251)

Assigned:2022-05-11
Published:2022-05-11
Updated:2023-01-05
Summary:cURL libcurl is vulnerable to a denial of service, caused by a flaw in the CURLOPT_CERTINFO option. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause a never ending busy-loop when trying to retrieve certificate chain information.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Consequences:Unknown
References:Source: MITRE
Type: CNA
CVE-2022-27781

Source: CCN
Type: Project curl Security Advisory, May 11 2022
CERTINFO never-ending busy-loop

Source: XF
Type: UNKNOWN
curl-cve202227781-dos(226251)

Source: support@hackerone.com
Type: Exploit, Third Party Advisory
support@hackerone.com

Source: support@hackerone.com
Type: Mailing List, Third Party Advisory
support@hackerone.com

Source: support@hackerone.com
Type: Third Party Advisory
support@hackerone.com

Source: support@hackerone.com
Type: Third Party Advisory
support@hackerone.com

Source: support@hackerone.com
Type: Mailing List, Third Party Advisory
support@hackerone.com

Source: CCN
Type: IBM Security Bulletin 6621463 (Spectrum Protect Plus)
Vulnerabilities in libcurl affect IBM Spectrum Protect Plus SQL, File Indexing, and Windows Host agents

Source: CCN
Type: IBM Security Bulletin 6823211 (PowerSC)
Multiple vulnerabilities in Curl affect PowerSC

Source: CCN
Type: IBM Security Bulletin 6826101 (MaaS360 Cloud Extender)
IBM MaaS360 Cloud Extender Agent and Base Module use libcurl with multiple known vulnerabilities

Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:ibm:spectrum_protect_plus:10.1.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7476
    P
    		curl-8.0.1-150400.5.23.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:127341
    P
    		Security update for curl (Important)
    2022-08-16
    oval:org.opensuse.security:def:125779
    P
    		Security update for curl (Important)
    2022-08-16
    oval:org.opensuse.security:def:126943
    P
    		Security update for curl (Important)
    2022-08-16
    oval:org.opensuse.security:def:94532
    P
    		curl-7.79.1-150400.3.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2902
    P
    		curl-7.79.1-150400.3.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:118720
    P
    		Security update for curl (Important)
    2022-05-27
    oval:org.opensuse.security:def:903
    P
    		Security update for curl (Important)
    2022-05-27
    oval:org.opensuse.security:def:119591
    P
    		Security update for curl (Important)
    2022-05-27
    oval:org.opensuse.security:def:118910
    P
    		Security update for curl (Important)
    2022-05-27
    oval:org.opensuse.security:def:119216
    P
    		Security update for curl (Important)
    2022-05-27
    oval:org.opensuse.security:def:42294
    P
    		Security update for curl (Important)
    2022-05-27
    oval:org.opensuse.security:def:119406
    P
    		Security update for curl (Important)
    2022-05-27
    oval:org.opensuse.security:def:42392
    P
    		Security update for curl (Important)
    2022-05-27
    oval:org.opensuse.security:def:5256
    P
    		Security update for curl (Important)
    2022-05-23
    oval:org.opensuse.security:def:6050
    P
    		Security update for curl (Important)
    2022-05-23
    BACK
    ibm spectrum protect plus 10.1.0