{"id":"CVE-2022-27774","aliases":["ALPINE-CVE-2022-27774","ALSA-2022:5313","BELL-CVE-2022-27774","CLSA-2022-1658855227","CLSA-2022-1658856012","CURL-CVE-2022-27774","DEBIAN-CVE-2022-27774","DLA-3288-1","DSA-5197-1","EUVD-2022-32270","GHSA-7xmh-mw7w-rr97","JLSEC-2026-386","MGASA-2022-0159","OESA-2022-1659","RHSA-2022:5245","RHSA-2022:5313","RLSA-2022:5313","SUSE-SU-2023:2225-1","UBUNTU-CVE-2022-27774","USN-5397-1","openSUSE-SU-2024:12028-1"],"status":"published","title":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82...","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0201,"percentile":0.81027,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-522"],"published":"2022-04-27T06:00:00Z","modified":"2026-11-03T08:01:10Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.79.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.79.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.79.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.80.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.83.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.83.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.83.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.83.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.83.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.83.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.83.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.83.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.83.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.83.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.83.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.83.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.5.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["7.83.1+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"curl","fixed_in":["7.81.0-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.79.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.79.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.79.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.80.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.83.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.83.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.83.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.83.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.83.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.83.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.83.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.83.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"7.83.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u4"}]}],"versions":["7.64.0-4","7.64.0-4+deb10u1","7.64.0-4+deb10u2","7.64.0-4+deb10u3"],"bundled":4},{"source":"osv","ecosystem":"Debian:11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u2"}]}],"versions":["7.74.0-1.3","7.74.0-1.3+deb11u1"],"bundled":15},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.5.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.83.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.5.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-13.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-13.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-4.oe2203"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8_6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.65.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.65.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.65.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13","7.35.0-1ubuntu2.20+esm14","7.35.0-1ubuntu2.20+esm15","7.35.0-1ubuntu2.20+esm16","7.35.0-1ubuntu2.20+esm17","7.35.0-1ubuntu2.20+esm18","7.35.0-1ubuntu2.20+esm19","7.35.0-1ubuntu2.20+esm20","7.35.0-1ubuntu2.20+esm21","7.35.0-1ubuntu2.20+esm22","7.35.0-1ubuntu2.20+esm23","7.35.0-1ubuntu2.20+esm24"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2","7.47.0-1ubuntu2.19+esm3","7.47.0-1ubuntu2.19+esm4","7.47.0-1ubuntu2.19+esm5","7.47.0-1ubuntu2.19+esm6","7.47.0-1ubuntu2.19+esm7","7.47.0-1ubuntu2.19+esm8","7.47.0-1ubuntu2.19+esm9","7.47.0-1ubuntu2.19+esm10","7.47.0-1ubuntu2.19+esm11","7.47.0-1ubuntu2.19+esm12","7.47.0-1ubuntu2.19+esm13","7.47.0-1ubuntu2.19+esm15","7.47.0-1ubuntu2.19+esm16","7.47.0-1ubuntu2.19+esm17","7.47.0-1ubuntu2.19+esm18","7.47.0-1ubuntu2.19+esm20","7.47.0-1ubuntu2.19+esm21"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.17"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.10"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.1"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.17"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.10"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.1"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.0-1.1"}]}],"bundled":4}],"products":[{"vendor":"broadcom","product":"fabric_operating_system"},{"vendor":"debian","product":"debian_linux"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"hci_bootstrap_os"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_storage_node"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1543773","tags":["x_transferred","exploit","Exploit","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220609-0008/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2022/dsa-5197","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202212-01","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27774","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220609-0008"},{"url":"https://github.com/advisories/GHSA-7xmh-mw7w-rr97"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-27774","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5313","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22576","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-27774","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-27776","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-27782","tags":["report"]},{"url":"https://bugzilla.redhat.com/2077541","tags":["report"]},{"url":"https://bugzilla.redhat.com/2077547","tags":["report"]},{"url":"https://bugzilla.redhat.com/2078408","tags":["report"]},{"url":"https://bugzilla.redhat.com/2082215","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-5313.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-27774","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1658855227.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1658856012.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27774.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-27774","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0159.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30352","tags":["report"]},{"url":"https://curl.se/docs/CVE-2022-22576.html","tags":["advisory","article"]},{"url":"https://curl.se/docs/CVE-2022-27774.html","tags":["advisory","article"]},{"url":"https://curl.se/docs/CVE-2022-27775.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2022-27776.html","tags":["advisory","article"]},{"url":"https://ubuntu.com/security/notices/USN-5397-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22576","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27776","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5245","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2078408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082215","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5245.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22576","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-27774","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-27776","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-27782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27782","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2022-27782.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5313.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:5313","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232225-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198608","tags":["report"]},{"url":"https://bugzilla.suse.com/1211230","tags":["report"]},{"url":"https://bugzilla.suse.com/1211231","tags":["report"]},{"url":"https://bugzilla.suse.com/1211232","tags":["report"]},{"url":"https://bugzilla.suse.com/1211233","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28322","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-27774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27776","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27776","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-27774","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.","status":"published","published":"2022-06-01T00:00:00Z","modified":"2026-10-14T16:20:02.641Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:34:33.913527Z"}],"euvd":[{"id":"EUVD-2022-32270","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.","status":"published","published":"2022-06-01T00:00:00Z","modified":"2026-10-14T16:20:02Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:14.304159Z"}],"ghsa":[{"id":"GHSA-7xmh-mw7w-rr97","title":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82...","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.","status":"published","published":"2022-06-03T00:01:03Z","modified":"2026-10-14T18:32:30Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:13:27.339015Z"}],"nvd":[{"id":"CVE-2022-27774","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.","status":"published","published":"2022-06-02T14:15:43.317Z","modified":"2026-10-14T17:17:36.29Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:07:21.261605Z"}],"osv":[{"id":"ALPINE-CVE-2022-27774","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.","status":"published","published":"2022-06-02T14:15:43.317Z","modified":"2026-11-03T07:18:33.14446806Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"BELL-CVE-2022-27774","title":"CVE-2022-27774 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:47.197Z","modified":"2026-01-26T09:46:29.518434Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-27774","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.","status":"published","published":"2022-06-01T00:00:00Z","modified":"2026-10-28T02:31:13.020627565Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DEBIAN-CVE-2022-27774","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.","status":"published","published":"2022-06-02T14:15:43.317Z","modified":"2026-11-03T08:01:10.284816916Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"JLSEC-2026-386","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:00:45.762931501Z","cvss":[{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2022-1659","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nThis security flaw in curl allows to reuse an OAUTH2 authenticated connection without properly ensuring that the connection is authenticated with the same credentials set by this transport, this issue can lead to authentication bypasses, either by mistake or by malicious actors.(CVE-2022-22576)\n\nWhen asked, curl does an HTTP(S) redirect. curl also supports authentication. When providing a user and password for a URL with a given hostname, curl makes an effort not to pass these credentials to other hosts in redirects unless permissions with special options are granted. This \"same host check\" has been flawed since its introduction. It does not work with cross-protocol redirection, nor does it treat different port numbers as separate hosts. This results in leaking credentials to other servers when curl redirects from authentication protected HTTP(S) URLs to other protocols and port numbers. It could also leak TLS SRP credentials in this way. By default, curl only allows redirects to HTTP(S) and FTP(S), but you can ask to allow redirects to all curl-supported protocols.(CVE-2022-27774)\n\nThis issue with curl occurs due to a logical bug where the configuration matching function does not take into account the IPv6 address zone id, which can cause curl to reuse the wrong connection when one transfer uses the zone id and subsequent transfers use another.(CVE-2022-27775)\n\nThis security flaw in curl allows leaking authentication or cookie header data over HTTP to redirect to the same host but a different port number, for applications passing custom Authorization: or Cookie: headers to the same set of headers Sending to servers on different port numbers is a problem, and these headers often contain privacy-sensitive information or data.(CVE-2022-27776)","status":"published","published":"2022-05-18T11:04:56Z","modified":"2026-08-18T01:16:31.123263858Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:5245","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2024-09-16T08:05:40Z","modified":"2026-06-30T10:02:10Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5313","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2024-09-16T08:05:32Z","modified":"2026-06-30T10:02:12Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:5313","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)\n\n* curl: credential leak on redirect (CVE-2022-27774)\n\n* curl: auth/cookie leak on redirect (CVE-2022-27776)\n\n* curl: TLS and SSH connection too eager reuse (CVE-2022-27782)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-28T10:52:02Z","modified":"2026-02-05T05:30:11.502086Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-27774","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.","status":"published","published":"2022-04-27T06:00:00Z","modified":"2026-10-17T12:55:57.753971405Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"ALSA-2022:5313","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\nSecurity Fix(es):\n* curl: OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)\n* curl: credential leak on redirect (CVE-2022-27774)\n* curl: auth/cookie leak on redirect (CVE-2022-27776)\n* curl: TLS and SSH connection too eager reuse (CVE-2022-27782)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-30T00:00:00Z","modified":"2026-10-29T11:01:06.636197831Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2022-1658855227","title":"Fixed CVEs in curl: CVE-2022-27776, CVE-2022-27774","description":"- CVE-2022-27774: fix credential leak on redirect\n- CVE-2022-27776: fix auth/cookie leak on redirect","status":"published","published":"2022-07-26T17:07:07Z","modified":"2026-10-21T10:47:56.488202941Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1658856012","title":"Fixed CVEs in curl: CVE-2022-27776, CVE-2022-27774","description":"- CVE-2022-27774: fix credential leak on redirect\n- CVE-2022-27776: fix auth/cookie leak on redirect","status":"published","published":"2022-07-26T17:20:12Z","modified":"2026-10-21T10:48:06.791982593Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CURL-CVE-2022-27774","title":"Credential leak on redirect","description":"curl follows HTTP(S) redirects when asked to. curl also supports\nauthentication. When a user and password are provided for a URL with a given\nhostname, curl makes an effort to not pass on those credentials to other hosts\nin redirects unless given permission with a special option.\n\nThis \"same host check\" has been flawed all since it was introduced. It does\nnot work on cross protocol redirects and it does not consider different port\nnumbers to be separate hosts. This leads to curl leaking credentials to other\nservers when it follows redirects from auth protected HTTP(S) URLs to other\nprotocols and port numbers. It could also leak the TLS SRP credentials this\nway.\n\nBy default, curl only allows redirects to HTTP(S) and FTP(S), but can be asked\nto allow redirects to all protocols curl supports.","status":"published","published":"2022-04-27T08:00:00Z","modified":"2026-10-25T01:16:44.453362309Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"DLA-3288-1","title":"curl - security update","status":"published","published":"2023-01-28T00:00:00Z","modified":"2026-03-09T01:21:05.844512Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5197-1","title":"curl - security update","status":"published","published":"2022-08-01T00:00:00Z","modified":"2026-03-09T02:10:41.680987Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0159","title":"Updated curl packages fix security vulnerability","description":"OAUTH2 bearer bypass in connection re-use. (CVE-2022-22576)\nCredential leak on redirect. (CVE-2022-27774)\nBad local IPv6 connection reuse. (CVE-2022-27775)\nAuth/cookie leak on redirect. (CVE-2022-27776)\n","status":"published","published":"2022-05-02T19:44:52Z","modified":"2026-04-16T04:43:09.028898805Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12028-1","title":"curl-7.83.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.83.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:43.406508Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2023:2225-1","title":"Security update for curl","description":"This update for curl adds the following feature:\n\nUpdate to version 8.0.1 (jsc#PED-2580)\n\n- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).\n- CVE-2023-28320: siglongjmp race condition (bsc#1211231).\n- CVE-2023-28321: IDN wildcard matching (bsc#1211232).\n- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).\n","status":"published","published":"2023-05-17T07:55:09Z","modified":"2026-02-04T03:51:12.77153Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"USN-5397-1","title":"curl vulnerabilities","description":"Patrick Monnerat discovered that curl incorrectly handled certain OAUTH2.\nAn attacker could possibly use this issue to access sensitive information.\n(CVE-2022-22576)\n\nHarry Sintonen discovered that curl incorrectly handled certain requests.\nAn attacker could possibly use this issue to expose sensitive information.\n(CVE-2022-27774, CVE-2022-27775, CVE-2022-27776)\n","status":"published","published":"2022-04-28T18:23:23Z","modified":"2026-05-29T18:00:43.654395992Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}