CVE-2022-32221: Infoleak
A vulnerability was found in curl. The issue occurs when doing HTTP(S) transfers, where curl might erroneously use the read callback (CURLOPTREADFUNCTION) to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set if it previously used the same handle to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent POST request.
Other sources
curl. Multiple issues were addressed by updating to curl version 7.86.0.
— Apple
when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPTREADFUNCTION) to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent POST request.
Reference:
https://curl.se/docs/CVE-2022-32221.html
— Red Hat
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPTREADFUNCTION) to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent POST request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
Credit
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2023-23499
- CVE-2022-42915
- CVE-2022-42916
- CVE-2022-32221
- CVE-2022-35260
- CVE-2022-35252
- CVE-2023-23513
- CVE-2023-23493
- CVE-2022-32915
- CVE-2023-23507
- CVE-2023-23516
- CVE-2023-23504
- CVE-2023-23502
- CVE-2022-42834
- CVE-2023-23497
- CVE-2023-23505
- CVE-2023-27931
- CVE-2023-23511
- CVE-2023-23518
- CVE-2023-23517
- CVE-2023-23508
- CVE-2023-32438
- CVE-2023-23520
- CVE-2023-23539
- CVE-2023-41990
- CVE-2023-23530
- CVE-2023-23531
- CVE-2023-23519
- CVE-2023-23500
- CVE-2023-23506
- CVE-2023-23498
- CVE-2023-23503
- CVE-2023-28208
- CVE-2023-23510
- CVE-2023-23512
- CVE-2022-3705
- CVE-2023-32393
- CVE-2023-23496
- CVE-2023-23501
- CVE-2022-0108
Frequently Asked Questions
What is CVE-2022-32221?
CVE-2022-32221 is a vulnerability in libcurl that can be exploited when using the read callback incorrectly.
How does CVE-2022-32221 affect macOS Monterey?
macOS Monterey version 12.6.3 is affected by CVE-2022-32221. Updating to version 12.6.3 remedies the vulnerability.
Which version of jbcs-httpd24-curl is affected by CVE-2022-32221 on Red Hat?
Versions up to and excluding 0:7.86.0-2.el8 and 0:7.86.0-2.el7 of jbcs-httpd24-curl on Red Hat are affected by CVE-2022-32221.
How severe is CVE-2022-32221?
CVE-2022-32221 has a severity level of medium.
Where can I find more information about CVE-2022-32221?
You can find more information about CVE-2022-32221 at the following links: [Apple Support](https://support.apple.com/en-us/HT213604), [CVE](https://www.cve.org/CVERecord?id=CVE-2022-32221), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-32221), [curl.se](https://curl.se/docs/CVE-2022-32221.html), and [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2135411).