Strix
26.1K

CVE-2022-42915

HIGHCVSS 8.1/10EPSS 2.93%

Last modified

CVE-2022-42915 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. EPSS estimates a 2.93% chance of exploitation in the next 30 days.

Description

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
2.93%

85.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HaxxCurl>= 7.77.0, < 7.86.0
FedoraprojectFedora35
FedoraprojectFedora36
FedoraprojectFedora37
NetappH300s FirmwareAll versions
NetappH500s FirmwareAll versions
NetappH700s FirmwareAll versions
NetappH410s FirmwareAll versions
NetappOntap 9All versions
AppleMacos>= 12.0.0, < 12.6.3
AppleMacos>= 13.0, < 13.2
SplunkUniversal Forwarder>= 8.2.0, < 8.2.12
SplunkUniversal Forwarder>= 9.0.0, < 9.0.6
SplunkUniversal Forwarder9.1.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-42915?
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
How severe is CVE-2022-42915?
CVE-2022-42915 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 2.93% probability of exploitation in the next 30 days.
How do I fix CVE-2022-42915?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-42915?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST