CVE-2022-27780
Fixed in a distro release EPSS 3%CVSS 5.3
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
Products: haxx curl, netapp solidfire_\&_hci_storage_node, netapp ontap_9, netapp solidfire_\&_hci_management_node, netapp hci_bootstrap_os, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.15 | curl | 7.80.0-r2 |
| Alpine 3.16 | curl | 7.83.1-r0 |
| Alpine 3.17 | curl | 7.83.1-r0 |
| Alpine 3.18 | curl | 7.83.1-r0 |
| Alpine 3.19 | curl | 7.83.1-r0 |
| Alpine 3.20 | curl | 7.83.1-r0 |
| Alpine 3.21 | curl | 7.83.1-r0 |
| Alpine 3.22 | curl | 7.83.1-r0 |
| Alpine 3.23 | curl | 7.83.1-r0 |
| Alpine 3.24 | curl | 7.83.1-r0 |
| Arch Linux | curl | 7.83.1-1 |
| Debian 12 | curl | 7.83.1-1 |
| Debian 13 | curl | 7.83.1-1 |
| Debian 14 | curl | 7.83.1-1 |
| Ubuntu 18.04 LTS | curl | 7.58.0-2ubuntu3.18 |
| Ubuntu 20.04 LTS | curl | 7.68.0-1ubuntu2.11 |
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.2 |
| openSUSE Tumbleweed | curl | 7.83.1-1.1 |