CVE-2022-42915

See a problem?

Source

https://nvd.nist.gov/vuln/detail/CVE-2022-42915

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42915.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-42915

Aliases

CURL-CVE-2022-42915

Related

Published

2022-10-29T20:15:09Z

Modified

2024-09-18T03:22:13.977482Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.

References

Affected packages

Alpine:v3.15 / curl

Package

Name: curl
Purl: pkg:apk/alpine/curl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.80.0-r4

Affected versions

7.*

7.19.2-r0

7.19.2-r1

7.19.4-r0

7.19.5-r0

7.19.6-r0

7.19.7-r0

7.19.7-r1

7.20.1-r0

7.20.1-r1

7.21.0-r0

7.21.1-r0

7.21.2-r0

7.21.3-r0

7.21.3-r1

7.21.4-r0

7.21.4-r1

7.21.5-r0

7.21.5-r1

7.21.6-r0

7.21.7-r0

7.21.7-r1

7.21.7-r2

7.22.0-r0

7.23.1-r0

7.24.0-r0

7.25.0-r0

7.26.0-r0

7.27.0-r0

7.27.0-r1

7.28.0-r0

7.28.1-r0

7.29.0-r0

7.30.0-r0

7.31.0-r0

7.32.0-r0

7.33.0-r0

7.33.0-r1

7.34.0-r0

7.34.0-r1

7.35.0-r0

7.36.0-r0

7.37.0-r0

7.37.1-r0

7.38.0-r0

7.39.0-r0

7.40.0-r0

7.41.0-r0

7.42.0-r0

7.42.1-r0

7.42.1-r1

7.43.0-r0

7.44.0-r0

7.45.0-r0

7.45.0-r1

7.46.0-r0

7.46.0-r1

7.46.0-r2

7.47.0-r0

7.47.1-r0

7.48.0-r0

7.49.0-r0

7.49.1-r0

7.50.0-r0

7.50.1-r0

7.50.2-r0

7.50.3-r0

7.50.3-r1

7.51.0-r0

7.51.0-r1

7.52.0-r0

7.52.1-r0

7.52.1-r1

7.53.0-r0

7.53.1-r0

7.53.1-r1

7.53.1-r2

7.53.1-r3

7.54.0-r0

7.54.1-r0

7.55.0-r0

7.55.1-r0

7.56.0-r0

7.56.1-r0

7.56.1-r1

7.57.0-r0

7.58.0-r0

7.58.0-r1

7.58.0-r2

7.59.0-r0

7.59.0-r1

7.60.0-r0

7.60.0-r1

7.61.0-r0

7.61.1-r0

7.62.0-r0

7.62.0-r1

7.62.0-r2

7.63.0-r0

7.64.0-r0

7.64.0-r1

7.64.1-r0

7.64.1-r1

7.64.1-r2

7.64.1-r3

7.65.0-r0

7.65.1-r0

7.65.3-r0

7.66.0-r0

7.67.0-r0

7.68.0-r0

7.69.0-r0

7.69.0-r1

7.69.1-r0

7.70.0-r0

7.70.0-r1

7.70.0-r2

7.71.0-r0

7.71.0-r1

7.71.1-r0

7.72.0-r0

7.73.0-r0

7.74.0-r0

7.75.0-r0

7.76.0-r0

7.76.1-r0

7.77.0-r0

7.77.0-r1

7.78.0-r0

7.78.0-r1

7.78.0-r2

7.79.0-r0

7.79.1-r0

7.80.0-r0

7.80.0-r1

7.80.0-r2

7.80.0-r3

Alpine:v3.16 / curl

Package

Name: curl
Purl: pkg:apk/alpine/curl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.83.1-r4

Affected versions

7.*

7.19.2-r0

7.19.2-r1

7.19.4-r0

7.19.5-r0

7.19.6-r0

7.19.7-r0

7.19.7-r1

7.20.1-r0

7.20.1-r1

7.21.0-r0

7.21.1-r0

7.21.2-r0

7.21.3-r0

7.21.3-r1

7.21.4-r0

7.21.4-r1

7.21.5-r0

7.21.5-r1

7.21.6-r0

7.21.7-r0

7.21.7-r1

7.21.7-r2

7.22.0-r0

7.23.1-r0

7.24.0-r0

7.25.0-r0

7.26.0-r0

7.27.0-r0

7.27.0-r1

7.28.0-r0

7.28.1-r0

7.29.0-r0

7.30.0-r0

7.31.0-r0

7.32.0-r0

7.33.0-r0

7.33.0-r1

7.34.0-r0

7.34.0-r1

7.35.0-r0

7.36.0-r0

7.37.0-r0

7.37.1-r0

7.38.0-r0

7.39.0-r0

7.40.0-r0

7.41.0-r0

7.42.0-r0

7.42.1-r0

7.42.1-r1

7.43.0-r0

7.44.0-r0

7.45.0-r0

7.45.0-r1

7.46.0-r0

7.46.0-r1

7.46.0-r2

7.47.0-r0

7.47.1-r0

7.48.0-r0

7.49.0-r0

7.49.1-r0

7.50.0-r0

7.50.1-r0

7.50.2-r0

7.50.3-r0

7.50.3-r1

7.51.0-r0

7.51.0-r1

7.52.0-r0

7.52.1-r0

7.52.1-r1

7.53.0-r0

7.53.1-r0

7.53.1-r1

7.53.1-r2

7.53.1-r3

7.54.0-r0

7.54.1-r0

7.55.0-r0

7.55.1-r0

7.56.0-r0

7.56.1-r0

7.56.1-r1

7.57.0-r0

7.58.0-r0

7.58.0-r1

7.58.0-r2

7.59.0-r0

7.59.0-r1

7.60.0-r0

7.60.0-r1

7.61.0-r0

7.61.1-r0

7.62.0-r0

7.62.0-r1

7.62.0-r2

7.63.0-r0

7.64.0-r0

7.64.0-r1

7.64.1-r0

7.64.1-r1

7.64.1-r2

7.64.1-r3

7.65.0-r0

7.65.1-r0

7.65.3-r0

7.66.0-r0

7.67.0-r0

7.68.0-r0

7.69.0-r0

7.69.0-r1

7.69.1-r0

7.70.0-r0

7.70.0-r1

7.70.0-r2

7.71.0-r0

7.71.0-r1

7.71.1-r0

7.72.0-r0

7.73.0-r0

7.74.0-r0

7.75.0-r0

7.76.0-r0

7.76.1-r0

7.77.0-r0

7.77.0-r1

7.78.0-r0

7.78.0-r1

7.78.0-r2

7.79.0-r0

7.79.1-r0

7.80.0-r0

7.81.0-r0

7.81.0-r1

7.82.0-r0

7.82.0-r1

7.83.0-r0

7.83.1-r0

7.83.1-r1

7.83.1-r2

7.83.1-r3

Alpine:v3.17 / curl

Package

Name: curl
Purl: pkg:apk/alpine/curl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.86.0-r0

Affected versions

7.*

7.19.2-r0

7.19.2-r1

7.19.4-r0

7.19.5-r0

7.19.6-r0

7.19.7-r0

7.19.7-r1

7.20.1-r0

7.20.1-r1

7.21.0-r0

7.21.1-r0

7.21.2-r0

7.21.3-r0

7.21.3-r1

7.21.4-r0

7.21.4-r1

7.21.5-r0

7.21.5-r1

7.21.6-r0

7.21.7-r0

7.21.7-r1

7.21.7-r2

7.22.0-r0

7.23.1-r0

7.24.0-r0

7.25.0-r0

7.26.0-r0

7.27.0-r0

7.27.0-r1

7.28.0-r0

7.28.1-r0

7.29.0-r0

7.30.0-r0

7.31.0-r0

7.32.0-r0

7.33.0-r0

7.33.0-r1

7.34.0-r0

7.34.0-r1

7.35.0-r0

7.36.0-r0

7.37.0-r0

7.37.1-r0

7.38.0-r0

7.39.0-r0

7.40.0-r0

7.41.0-r0

7.42.0-r0

7.42.1-r0

7.42.1-r1

7.43.0-r0

7.44.0-r0

7.45.0-r0

7.45.0-r1

7.46.0-r0

7.46.0-r1

7.46.0-r2

7.47.0-r0

7.47.1-r0

7.48.0-r0

7.49.0-r0

7.49.1-r0

7.50.0-r0

7.50.1-r0

7.50.2-r0

7.50.3-r0

7.50.3-r1

7.51.0-r0

7.51.0-r1

7.52.0-r0

7.52.1-r0

7.52.1-r1

7.53.0-r0

7.53.1-r0

7.53.1-r1

7.53.1-r2

7.53.1-r3

7.54.0-r0

7.54.1-r0

7.55.0-r0

7.55.1-r0

7.56.0-r0

7.56.1-r0

7.56.1-r1

7.57.0-r0

7.58.0-r0

7.58.0-r1

7.58.0-r2

7.59.0-r0

7.59.0-r1

7.60.0-r0

7.60.0-r1

7.61.0-r0

7.61.1-r0

7.62.0-r0

7.62.0-r1

7.62.0-r2

7.63.0-r0

7.64.0-r0

7.64.0-r1

7.64.1-r0

7.64.1-r1

7.64.1-r2

7.64.1-r3

7.65.0-r0

7.65.1-r0

7.65.3-r0

7.66.0-r0

7.67.0-r0

7.68.0-r0

7.69.0-r0

7.69.0-r1

7.69.1-r0

7.70.0-r0

7.70.0-r1

7.70.0-r2

7.71.0-r0

7.71.0-r1

7.71.1-r0

7.72.0-r0

7.73.0-r0

7.74.0-r0

7.75.0-r0

7.76.0-r0

7.76.1-r0

7.77.0-r0

7.77.0-r1

7.78.0-r0

7.78.0-r1

7.78.0-r2

7.79.0-r0

7.79.1-r0

7.80.0-r0

7.81.0-r0

7.81.0-r1

7.82.0-r0

7.82.0-r1

7.83.0-r0

7.83.1-r0

7.83.1-r1

7.84.0-r0

7.84.0-r1

7.84.0-r2

7.85.0-r0

Alpine:v3.18 / curl

Package

Name: curl
Purl: pkg:apk/alpine/curl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.86.0-r0

Affected versions

7.*

7.19.2-r0

7.19.2-r1

7.19.4-r0

7.19.5-r0

7.19.6-r0

7.19.7-r0

7.19.7-r1

7.20.1-r0

7.20.1-r1

7.21.0-r0

7.21.1-r0

7.21.2-r0

7.21.3-r0

7.21.3-r1

7.21.4-r0

7.21.4-r1

7.21.5-r0

7.21.5-r1

7.21.6-r0

7.21.7-r0

7.21.7-r1

7.21.7-r2

7.22.0-r0

7.23.1-r0

7.24.0-r0

7.25.0-r0

7.26.0-r0

7.27.0-r0

7.27.0-r1

7.28.0-r0

7.28.1-r0

7.29.0-r0

7.30.0-r0

7.31.0-r0

7.32.0-r0

7.33.0-r0

7.33.0-r1

7.34.0-r0

7.34.0-r1

7.35.0-r0

7.36.0-r0

7.37.0-r0

7.37.1-r0

7.38.0-r0

7.39.0-r0

7.40.0-r0

7.41.0-r0

7.42.0-r0

7.42.1-r0

7.42.1-r1

7.43.0-r0

7.44.0-r0

7.45.0-r0

7.45.0-r1

7.46.0-r0

7.46.0-r1

7.46.0-r2

7.47.0-r0

7.47.1-r0

7.48.0-r0

7.49.0-r0

7.49.1-r0

7.50.0-r0

7.50.1-r0

7.50.2-r0

7.50.3-r0

7.50.3-r1

7.51.0-r0

7.51.0-r1

7.52.0-r0

7.52.1-r0

7.52.1-r1

7.53.0-r0

7.53.1-r0

7.53.1-r1

7.53.1-r2

7.53.1-r3

7.54.0-r0

7.54.1-r0

7.55.0-r0

7.55.1-r0

7.56.0-r0

7.56.1-r0

7.56.1-r1

7.57.0-r0

7.58.0-r0

7.58.0-r1

7.58.0-r2

7.59.0-r0

7.59.0-r1

7.60.0-r0

7.60.0-r1

7.61.0-r0

7.61.1-r0

7.62.0-r0

7.62.0-r1

7.62.0-r2

7.63.0-r0

7.64.0-r0

7.64.0-r1

7.64.1-r0

7.64.1-r1

7.64.1-r2

7.64.1-r3

7.65.0-r0

7.65.1-r0

7.65.3-r0

7.66.0-r0

7.67.0-r0

7.68.0-r0

7.69.0-r0

7.69.0-r1

7.69.1-r0

7.70.0-r0

7.70.0-r1

7.70.0-r2

7.71.0-r0

7.71.0-r1

7.71.1-r0

7.72.0-r0

7.73.0-r0

7.74.0-r0

7.75.0-r0

7.76.0-r0

7.76.1-r0

7.77.0-r0

7.77.0-r1

7.78.0-r0

7.78.0-r1

7.78.0-r2

7.79.0-r0

7.79.1-r0

7.80.0-r0

7.81.0-r0

7.81.0-r1

7.82.0-r0

7.82.0-r1

7.83.0-r0

7.83.1-r0

7.83.1-r1

7.84.0-r0

7.84.0-r1

7.84.0-r2

7.85.0-r0

Alpine:v3.19 / curl

Package

Name: curl
Purl: pkg:apk/alpine/curl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.86.0-r0

Affected versions

7.*

7.19.2-r0

7.19.2-r1

7.19.4-r0

7.19.5-r0

7.19.6-r0

7.19.7-r0

7.19.7-r1

7.20.1-r0

7.20.1-r1

7.21.0-r0

7.21.1-r0

7.21.2-r0

7.21.3-r0

7.21.3-r1

7.21.4-r0

7.21.4-r1

7.21.5-r0

7.21.5-r1

7.21.6-r0

7.21.7-r0

7.21.7-r1

7.21.7-r2

7.22.0-r0

7.23.1-r0

7.24.0-r0

7.25.0-r0

7.26.0-r0

7.27.0-r0

7.27.0-r1

7.28.0-r0

7.28.1-r0

7.29.0-r0

7.30.0-r0

7.31.0-r0

7.32.0-r0

7.33.0-r0

7.33.0-r1

7.34.0-r0

7.34.0-r1

7.35.0-r0

7.36.0-r0

7.37.0-r0

7.37.1-r0

7.38.0-r0

7.39.0-r0

7.40.0-r0

7.41.0-r0

7.42.0-r0

7.42.1-r0

7.42.1-r1

7.43.0-r0

7.44.0-r0

7.45.0-r0

7.45.0-r1

7.46.0-r0

7.46.0-r1

7.46.0-r2

7.47.0-r0

7.47.1-r0

7.48.0-r0

7.49.0-r0

7.49.1-r0

7.50.0-r0

7.50.1-r0

7.50.2-r0

7.50.3-r0

7.50.3-r1

7.51.0-r0

7.51.0-r1

7.52.0-r0

7.52.1-r0

7.52.1-r1

7.53.0-r0

7.53.1-r0

7.53.1-r1

7.53.1-r2

7.53.1-r3

7.54.0-r0

7.54.1-r0

7.55.0-r0

7.55.1-r0

7.56.0-r0

7.56.1-r0

7.56.1-r1

7.57.0-r0

7.58.0-r0

7.58.0-r1

7.58.0-r2

7.59.0-r0

7.59.0-r1

7.60.0-r0

7.60.0-r1

7.61.0-r0

7.61.1-r0

7.62.0-r0

7.62.0-r1

7.62.0-r2

7.63.0-r0

7.64.0-r0

7.64.0-r1

7.64.1-r0

7.64.1-r1

7.64.1-r2

7.64.1-r3

7.65.0-r0

7.65.1-r0

7.65.3-r0

7.66.0-r0

7.67.0-r0

7.68.0-r0

7.69.0-r0

7.69.0-r1

7.69.1-r0

7.70.0-r0

7.70.0-r1

7.70.0-r2

7.71.0-r0

7.71.0-r1

7.71.1-r0

7.72.0-r0

7.73.0-r0

7.74.0-r0

7.75.0-r0

7.76.0-r0

7.76.1-r0

7.77.0-r0

7.77.0-r1

7.78.0-r0

7.78.0-r1

7.78.0-r2

7.79.0-r0

7.79.1-r0

7.80.0-r0

7.81.0-r0

7.81.0-r1

7.82.0-r0

7.82.0-r1

7.83.0-r0

7.83.1-r0

7.83.1-r1

7.84.0-r0

7.84.0-r1

7.84.0-r2

7.85.0-r0

Alpine:v3.20 / curl

Package

Name: curl
Purl: pkg:apk/alpine/curl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.86.0-r0

Affected versions

7.*

7.19.2-r0

7.19.2-r1

7.19.4-r0

7.19.5-r0

7.19.6-r0

7.19.7-r0

7.19.7-r1

7.20.1-r0

7.20.1-r1

7.21.0-r0

7.21.1-r0

7.21.2-r0

7.21.3-r0

7.21.3-r1

7.21.4-r0

7.21.4-r1

7.21.5-r0

7.21.5-r1

7.21.6-r0

7.21.7-r0

7.21.7-r1

7.21.7-r2

7.22.0-r0

7.23.1-r0

7.24.0-r0

7.25.0-r0

7.26.0-r0

7.27.0-r0

7.27.0-r1

7.28.0-r0

7.28.1-r0

7.29.0-r0

7.30.0-r0

7.31.0-r0

7.32.0-r0

7.33.0-r0

7.33.0-r1

7.34.0-r0

7.34.0-r1

7.35.0-r0

7.36.0-r0

7.37.0-r0

7.37.1-r0

7.38.0-r0

7.39.0-r0

7.40.0-r0

7.41.0-r0

7.42.0-r0

7.42.1-r0

7.42.1-r1

7.43.0-r0

7.44.0-r0

7.45.0-r0

7.45.0-r1

7.46.0-r0

7.46.0-r1

7.46.0-r2

7.47.0-r0

7.47.1-r0

7.48.0-r0

7.49.0-r0

7.49.1-r0

7.50.0-r0

7.50.1-r0

7.50.2-r0

7.50.3-r0

7.50.3-r1

7.51.0-r0

7.51.0-r1

7.52.0-r0

7.52.1-r0

7.52.1-r1

7.53.0-r0

7.53.1-r0

7.53.1-r1

7.53.1-r2

7.53.1-r3

7.54.0-r0

7.54.1-r0

7.55.0-r0

7.55.1-r0

7.56.0-r0

7.56.1-r0

7.56.1-r1

7.57.0-r0

7.58.0-r0

7.58.0-r1

7.58.0-r2

7.59.0-r0

7.59.0-r1

7.60.0-r0

7.60.0-r1

7.61.0-r0

7.61.1-r0

7.62.0-r0

7.62.0-r1

7.62.0-r2

7.63.0-r0

7.64.0-r0

7.64.0-r1

7.64.1-r0

7.64.1-r1

7.64.1-r2

7.64.1-r3

7.65.0-r0

7.65.1-r0

7.65.3-r0

7.66.0-r0

7.67.0-r0

7.68.0-r0

7.69.0-r0

7.69.0-r1

7.69.1-r0

7.70.0-r0

7.70.0-r1

7.70.0-r2

7.71.0-r0

7.71.0-r1

7.71.1-r0

7.72.0-r0

7.73.0-r0

7.74.0-r0

7.75.0-r0

7.76.0-r0

7.76.1-r0

7.77.0-r0

7.77.0-r1

7.78.0-r0

7.78.0-r1

7.78.0-r2

7.79.0-r0

7.79.1-r0

7.80.0-r0

7.81.0-r0

7.81.0-r1

7.82.0-r0

7.82.0-r1

7.83.0-r0

7.83.1-r0

7.83.1-r1

7.84.0-r0

7.84.0-r1

7.84.0-r2

7.85.0-r0

Debian:12 / curl

Package

Name: curl
Purl: pkg:deb/debian/curl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.86.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / curl

Package

Name: curl
Purl: pkg:deb/debian/curl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.86.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/curl/curl

Affected ranges

Type: GIT
Repo: https://github.com/curl/curl
Events: Introduced

6b951a6928811507d493303b2878e848c077b471

Fixed

cd95ee9f771361acf241629d2fe5507e308082a2

Affected versions

Other

curl-7_77_0

curl-7_78_0

curl-7_79_0

curl-7_79_1

curl-7_80_0

curl-7_81_0

curl-7_82_0

curl-7_83_0

curl-7_83_1

curl-7_84_0

curl-7_85_0