7.5 High

CVE-2022-27781 libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's…

Description

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Affected products and versions

Product	Affected versions	Fixed in
https://github.com/curl/curl	Versions not published
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.0 → < 3.1.5	3.1.5
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1	3.1.0 → < 3.1.5	3.1.5
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.0 → < 3.1.5	3.1.5

References

hackerone.com hackerone.com
security.netapp.com security.netapp.com
DSA-5197 www.debian.org
[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update lists.debian.org
GLSA-202212-01 security.gentoo.org

Timeline

Published June 1, 2022
Last modified October 14, 2026

The 51 CVEs of https://github.com/curl/curl →

CVE-2023-28322 An information disclosure vulnerability exists in… 5.3 Medium CVE-2023-28319 A use after free vulnerability exists in… 7.5 High CVE-2023-28320 A denial of service vulnerability exists in… 5.9 Medium CVE-2023-28321 An improper certificate validation vulnerability exists in… 5.9 Medium

Track this CVE

CVE-2022-27781 libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's…

Description

Affected products and versions

References

Timeline

Other CVEs of https://github.com/curl/curl