CVE-2022-27778

Description

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

CVSS breakdown

Affected products

• haxx / curl7.83.0 – 7.83.0
• NetApp / active_iq_unified_manager
• NetApp / active_iq_unified_manager
• NetApp / bh500s_firmware
• NetApp / Clustered Data ONTAP
• NetApp / h300s_firmware
• NetApp / h410s_firmware
• NetApp / h700s_firmware
• NetApp / hci_compute_node_firmware
• NetApp / OnCommand Insight
• NetApp / OnCommand Workflow Automation
• NetApp / SnapCenter
• NetApp / solidfire_&_hci_management_node
• oracle / mysql_server5.7.38
• Splunk / Universal Forwarder8.2.0 – 8.2.12
• Splunk / Universal Forwarder9.1.0 – 9.1.0

References

• MISChttps://hackerone.com/reports/1553598
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2022.html
• MISChttps://security.netapp.com/advisory/ntap-20220609-0009/
• MISChttps://security.netapp.com/advisory/ntap-20220729-0004/