Read the docs
Red Hat Security Advisory

RHSA-2022:5313

curl security update

Released 2022-06-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 4 records

TI-2022-10666 CVE-2022-27782 · GHSA-x38v-8q6p-w65c

Improper certificate validation in https://github.com/curl/curl

Priority HIGH 72

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttra…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03095 Published 2022-06-01 Partial fix CWE-840
TI-2022-06845 CVE-2022-22576 · GHSA-2r69-696x-qxj9

Improper authentication in https://github.com/curl/curl

Priority HIGH 70

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.02523 Published 2022-05-26 Partial fix CWE-287
TI-2022-10658 CVE-2022-27774 · GHSA-7xmh-mw7w-rr97

Insufficiently protected credentials in https://github.com/curl/curl

Priority MEDIUM 59

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authenticat…

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.0201 Published 2022-06-01 Partial fix CWE-522
TI-2022-10660 CVE-2022-27776 · GHSA-hc85-wpv5-52wh

Insufficiently protected credentials in https://github.com/curl/curl

Priority LOW 36

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.04098 Published 2022-06-01 Partial fix CWE-522