Vulnerability Description
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | < 7.86.0 |
| Netapp | Clustered Data Ontap | - |
| Netapp | H300S Firmware | - |
| Netapp | H300S | - |
| Netapp | H500S Firmware | - |
| Netapp | H500S | - |
| Netapp | H700S Firmware | - |
| Netapp | H700S | - |
| Netapp | H410S Firmware | - |
| Netapp | H410S | - |
| Debian | Debian Linux | 10.0 |
| Apple | Macos | < 12.6.3 |
| Splunk | Universal Forwarder | >= 8.2.0, < 8.2.12 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2023/Jan/19Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2023/Jan/20Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2023/05/17/4Mailing List
- https://hackerone.com/reports/1704017ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230110-0006/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230208-0002/Third Party Advisory
- https://support.apple.com/kb/HT213604Third Party Advisory
- https://support.apple.com/kb/HT213605Third Party Advisory
- https://www.debian.org/security/2023/dsa-5330Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jan/19Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2023/Jan/20Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2023/05/17/4Mailing List
- https://hackerone.com/reports/1704017ExploitIssue TrackingThird Party Advisory
FAQ
What is CVE-2022-32221?
CVE-2022-32221 is a vulnerability with a CVSS score of 9.8 (CRITICAL). When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same hand...
How severe is CVE-2022-32221?
CVE-2022-32221 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-32221?
Check the references section above for vendor advisories and patch information. Affected products include: Haxx Curl, Netapp Clustered Data Ontap, Netapp H300S Firmware, Netapp H300S, Netapp H500S Firmware.