CVE-2022-30115

MEDIUM

4.3

Beschreibung

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.

CVE Details

CVSS v3.1 Bewertung4.3

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht6/2/2022

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

haxx:curlnetapp:clustered_data_ontapnetapp:h300snetapp:h300s_firmwarenetapp:h410snetapp:h410s_firmwarenetapp:h500snetapp:h500s_firmwarenetapp:h700snetapp:h700s_firmwarenetapp:hci_bootstrap_osnetapp:hci_compute_nodenetapp:solidfire\,_enterprise_sds_\&_hci_storage_nodenetapp:solidfire_\&_hci_management_nodesplunk:universal_forwarder

Schwachen (CWE)

CWE-325CWE-319

Referenzen

http://www.openwall.com/lists/oss-security/2022/10/26/4(support@hackerone.com)

http://www.openwall.com/lists/oss-security/2022/12/21/1(support@hackerone.com)

https://hackerone.com/reports/1557449(support@hackerone.com)

https://security.gentoo.org/glsa/202212-01(support@hackerone.com)

https://security.netapp.com/advisory/ntap-20220609-0009/(support@hackerone.com)

http://www.openwall.com/lists/oss-security/2022/10/26/4(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2022/12/21/1(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/reports/1557449(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202212-01(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20220609-0009/(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.