Description
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- apple / macos13.0
- Debian / debian_linux10.0 – 10.0
- Debian / debian_linux11.0 – 11.0
- fedoraproject / fedora35 – 35
- haxx / curl7.16.4 – 7.84.0
- netapp / bootstrap_os
- netapp / Clustered Data ONTAP
- netapp / element_software
- netapp / h300s_firmware
- netapp / h410s_firmware
- netapp / h500s_firmware
- netapp / h700s_firmware
- netapp / hci_management_node
- netapp / solidfire
- Splunk / Universal Forwarder8.2.0 – 8.2.12
- Splunk / Universal Forwarder9.1.0 – 9.1.0
References
- MISChttps://hackerone.com/reports/1590071
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
- VENDOR_ADVISORYhttps://www.debian.org/security/2022/dsa-5197
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
- MISChttps://security.netapp.com/advisory/ntap-20220915-0003/
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213488
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Oct/41
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Oct/28
- MISChttps://security.gentoo.org/glsa/202212-01
Updated 44m ago · 8 sources