CVE-2022-27782 describes a vulnerability in libcurl where it improperly reuses connections, even when TLS or SSH-related options have changed, affecting products like Debian curl, Haxx curl, and Splunk curl. This high-severity vulnerability (CVSS 7.5) has a network attack vector and low attack complexity, potentially leading to integrity impacts by allowing unintended connection reuse. While there is no evidence of active exploitation, no public exploit code, and it's not on the KEV catalog, it has garnered some community discussion and media coverage, indicating awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.83.1CPE matchmatch criteria | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | ||
>= 8.2.0, < 8.2.12CPE matchmatch criteria | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* | ||
>= 9.0.0, < 9.0.6CPE matchmatch criteria | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
August Third Party Package Updates in Splunk Universal Forwarder
Aug 30, 2023libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However several TLS andSSH settings were left out from the configuration match checks making themmatch too easily.
Jun 14, 2022curl: TLS and SSH connection too eager reuse
May 11, 2022TLS and SSH connection too eager reuse
May 11, 2022