| Vulnerability Name: | CVE-2022-32206 (CCN-229740) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2022-06-27 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2022-06-27 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2023-02-15 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) 5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
5.7 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-770 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2022-32206 Source: support@hackerone.com Type: Mailing List, Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Mailing List, Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: UNKNOWN support@hackerone.com Source: support@hackerone.com Type: Patch, Third Party Advisory support@hackerone.com Source: CCN Type: Project curl Security Advisory, June 27th 2022 CVE-2022-32206: HTTP compression denial of service Source: XF Type: UNKNOWN curl-cve202232206-dos(229740) Source: support@hackerone.com Type: Exploit, Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Mailing List, Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Mailing List, Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Third Party Advisory support@hackerone.com Source: CCN Type: IBM Security Bulletin 6621463 (Spectrum Protect Plus) Vulnerabilities in libcurl affect IBM Spectrum Protect Plus SQL, File Indexing, and Windows Host agents Source: CCN Type: IBM Security Bulletin 6824759 (MQ Operator) IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from curl, systemd, and Golang Go Source: CCN Type: IBM Security Bulletin 6826107 (MaaS360 Cloud Extender) IBM MaaS360 Cloud Extender Agent and Base Module uses libcurl with multiple known vulnerabilities (CVE-2022-32205, CVE-2022-32206, CVE-2022-32207, CVE-2022-32208) Source: CCN Type: IBM Security Bulletin 6826393 (Spectrum Copy Data Management) Security Bulletin: Vulnerabilities in libcurl may affect IBM Spectrum Copy Data Management (CVE-2022-32206, CVE-2022-32208) Source: CCN Type: IBM Security Bulletin 6831591 (Robotic Process Automation) Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak Source: CCN Type: IBM Security Bulletin 6834014 (MQ) IBM MQ is affected by a vulnerability in libcurl (CVE-2022-32206) Source: CCN Type: IBM Security Bulletin 6845365 (QRadar WinCollect Agent) IBM QRadar Wincollect agent is vulnerable to using components with know vulnerabilities Source: CCN Type: IBM Security Bulletin 6847643 (Spectrum Protect Plus) Vulnerabilities in Linux Kernel, Golang Go, and cURL libcurl may affect IBM Spectrum Protect Plus Source: CCN Type: IBM Security Bulletin 6848225 (Netcool Operations Insight) Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities. Source: CCN Type: IBM Security Bulletin 6855297 (Security Verify Access) IBM Security Verify Access Appliance includes components with known vulnerabilities Source: CCN Type: IBM Security Bulletin 6855601 (Rational ClearCase) Multiple vulnerabilities in libcURL affect IBM Rational ClearCase ( CVE-2022-42915, CVE-2022-42916, CVE-2022-32221, CVE-2022-35252, CVE-2022-32205, CVE-2022-32206, CVE-2022-32207 ) Source: CCN Type: IBM Security Bulletin 6856467 (PowerSC) Multiple vulnerabilities in Curl affect PowerSC Source: CCN Type: IBM Security Bulletin 6857803 (Cloud Pak for Watson AIOps) Multiple Vulnerabilities in CloudPak for Watson AIOPs Source: CCN Type: IBM Security Bulletin 6967687 (Watson Speech Services Cartridge for Cloud Pak for Data) IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to denial of service in cURL libcurl (CVE-2022-32206) Source: CCN Type: IBM Security Bulletin 6984347 (Engineering Requirements Management DOORS) IBM Engineering Requirements Management DOORS/DWA vulnerabilities fixes for 9.7.2.6 Source: CCN Type: Mend Vulnerability Database CVE-2022-32206 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration RedHat 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||