Strix
26.1K

CVE-2022-32205

MEDIUMCVSS 4.3/10EPSS 26.91%

Last modified

CVE-2022-32205 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. EPSS estimates a 26.91% chance of exploitation in the next 30 days.

Description

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.

Metrics

CVSS 3.1
4.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

EPSS Probability
26.91%

97.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HaxxCurl>= 7.71.0, < 7.84.0
FedoraprojectFedora35
DebianDebian Linux11.0
NetappClustered Data OntapAll versions
NetappElement SoftwareAll versions
NetappHci Management NodeAll versions
NetappSolidfireAll versions
NetappH300s FirmwareAll versions
NetappH500s FirmwareAll versions
NetappH700s FirmwareAll versions
NetappH410s FirmwareAll versions
AppleMacos< 13.0
SiemensScalance Sc622-2c Firmware< 3.0
SiemensScalance Sc626-2c Firmware< 3.0
SiemensScalance Sc632-2c Firmware< 3.0
SiemensScalance Sc636-2c Firmware< 3.0
SiemensScalance Sc642-2c Firmware< 3.0
SiemensScalance Sc646-2c Firmware< 3.0
SplunkUniversal Forwarder>= 8.2.0, < 8.2.12
SplunkUniversal Forwarder>= 9.0.0, < 9.0.6
SplunkUniversal Forwarder9.1.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-32205?
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.
How severe is CVE-2022-32205?
CVE-2022-32205 has a CVSS score of 4.3/10 (MEDIUM severity). The EPSS model estimates a 26.91% probability of exploitation in the next 30 days.
How do I fix CVE-2022-32205?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-32205?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST