Description
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Apple / macOS13.0
- Debian / debian_linux11.0 – 11.0
- fedoraproject / fedora35 – 35
- haxx / curl7.69.0 – 7.84.0
- NetApp / bootstrap_os
- NetApp / Clustered Data ONTAP
- NetApp / element_software
- NetApp / h300s_firmware
- NetApp / h410s_firmware
- NetApp / h500s_firmware
- NetApp / h700s_firmware
- NetApp / hci_management_node
- NetApp / solidfire
- Splunk / Universal Forwarder8.2.0 – 8.2.12
- Splunk / Universal Forwarder9.1.0 – 9.1.0
References
- MISChttps://hackerone.com/reports/1573634
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
- VENDOR_ADVISORYhttps://www.debian.org/security/2022/dsa-5197
- MISChttps://security.netapp.com/advisory/ntap-20220915-0003/
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213488
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Oct/41
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Oct/28
- MISChttps://security.gentoo.org/glsa/202212-01
Updated 24m ago · 8 sources