CVE-2022-35252
23.09.2022, 14:15
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| haxx | curl | 𝑥 < 7.85.0 |
| netapp | clustered_data_ontap | - |
| netapp | element_software | - |
| netapp | hci_management_node | - |
| netapp | solidfire | - |
| netapp | bootstrap_os | - |
| netapp | h300s_firmware | - |
| netapp | h500s_firmware | - |
| netapp | h700s_firmware | - |
| netapp | h410s_firmware | - |
| apple | macos | 11.0 ≤ 𝑥 < 11.7.3 |
| apple | macos | 12.0.0 ≤ 𝑥 < 12.6.3 |
| debian | debian_linux | 10.0 |
| splunk | universal_forwarder | 8.2.0 ≤ 𝑥 < 8.2.12 |
| splunk | universal_forwarder | 9.0.0 ≤ 𝑥 < 9.0.6 |
| splunk | universal_forwarder | 9.1.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| curl |
| ||||||||||||||||||||||||||||||||||||||||||||||
| libcurl-devel |
| ||||||||||||||||||||||||||||||||||||||||||||||
| libcurl4 |
| ||||||||||||||||||||||||||||||||||||||||||||||
| libcurl4-32bit |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| curl |
| ||||||||||||
| curl-minimal |
| ||||||||||||
| libcurl |
| ||||||||||||
| libcurl-devel |
| ||||||||||||
| libcurl-minimal |
|
Common Weakness Enumeration
References