Vulnerabilities > CVE-2022-27775

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

NVD

Published: 2022-06-02

Updated: 2024-11-21

Summary

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.

Vulnerable Configurations

Part	Description	Count
Application	Haxx Haxx Curl 7.65.0 Haxx Curl 7.65.1 Haxx Curl 7.65.2 Haxx Curl 7.65.3 Haxx Curl 7.66.0 Haxx Curl 7.67.0 Haxx Curl 7.68.0 Haxx Curl 7.69.0 Haxx Curl 7.69.1 Haxx Curl 7.70.0 Haxx Curl 7.71.0 Haxx Curl 7.71.1 Haxx Curl 7.72.0 Haxx Curl 7.73.0 Haxx Curl 7.74.0 Haxx Curl 7.75.0 Haxx Curl 7.76.0 Haxx Curl 7.76.1 Haxx Curl 7.77.0 Haxx Curl 7.78.0 Haxx Curl 7.79.0 Haxx Curl 7.79.1 Haxx Curl 7.80.0 Haxx Curl 7.81.0 Haxx Curl 7.82.0	25
Application	Netapp Netapp Clustered Data Ontap - Netapp Solidfire & HCI Management Node - Netapp Solidfire & HCI Storage Node -	3
Application	Splunk Splunk Universal Forwarder 9.1.0 Splunk Universal Forwarder 9.0.0 Splunk Universal Forwarder 9.0.1 Splunk Universal Forwarder 9.0.2 Splunk Universal Forwarder 9.0.3 Splunk Universal Forwarder 9.0.4 Splunk Universal Forwarder 9.0.5 Splunk Universal Forwarder 8.2.0 Splunk Universal Forwarder 8.2.6 Splunk Universal Forwarder 8.2.7 Splunk Universal Forwarder 8.2.8 Splunk Universal Forwarder 8.2.9 Splunk Universal Forwarder 8.2.10 Splunk Universal Forwarder 8.2.11	14
OS	Debian Debian Debian Linux 11.0	1
OS	Netapp Netapp HCI Bootstrap OS - Netapp H300S Firmware - Netapp H500S Firmware - Netapp H700S Firmware - Netapp H410S Firmware -	5
OS	Brocade Brocade Fabric Operating System -	1
Hardware	Netapp Netapp HCI Compute Node - Netapp H300S - Netapp H500S - Netapp H700S - Netapp H410S -	5

References

CVE is a registered MITRE Corporation trademark and MITRE's CVE website is the authoritative source of CVE content. CWE is a registered MITRE Corporation trademark and MITRE's CWE website is the authoritative source of CWE content.