CVE-2022-43552 is a use-after-free vulnerability in curl versions prior to 7.87.0, affecting products like Apple macOS and Splunk Universal Forwarder. This flaw occurs when curl attempts to tunnel SMB or TELNET protocols through an HTTP proxy that denies the operation, leading to the use of a freed heap-allocated struct during transfer shutdown. Rated as MEDIUM severity (CVSS 5.9), it has a network attack vector and high attack complexity, potentially leading to denial of service. There is no evidence of active exploitation, public exploit code, or Metasploit/Nuclei modules, though it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.87.0CPE matchmatch criteria | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | ||
>= 13.0, < 13.3CPE matchmatch criteria | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | ||
>= 8.2.0, < 8.2.12CPE matchmatch criteria | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* | ||
>= 9.0.0, < 9.0.6CPE matchmatch criteria | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* | ||
9.1.0CPE matchmatch criteria | cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
August Third Party Package Updates in Splunk Universal Forwarder
Aug 30, 2023A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET curl would use a heap-allocated struct after it had been freed in its transfer shutdown code path.
Feb 14, 2023curl: Use-after-free triggered by an HTTP proxy deny response
Dec 21, 2022HTTP Proxy deny use after free
Dec 21, 2022