CVE-2022-35252

 

Published at: - 23-09-2022 04:15

Last modified: - 29-01-2023 01:15

Total changes: - 9

Description

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

 

Verification logic

 

Reference

• https://hackerone.com/reports/1613943
• https://security.netapp.com/advisory/ntap-20220930-0005/
• GLSA-202212-01-Third Party Advisory
• https://support.apple.com/kb/HT213604
• https://support.apple.com/kb/HT213603
• 20230123 APPLE-SA-2023-01-23-6 macOS Big Sur 11.7.3-
• 20230123 APPLE-SA-2023-01-23-5 macOS Monterey 12.6.3-
• [debian-lts-announce] 20230128 [SECURITY] [DLA 3288-1] curl security update-

 

Keywords

NVD

 

CVE-2022-35252

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures