CVE-2022-32206

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-32206
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://seclists.org/fulldisclosure/2022/Oct/28 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Oct/41 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/15/3 Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf Patch Third Party Advisory
https://hackerone.com/reports/1570651 Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202212-01 Third Party Advisory
https://security.netapp.com/advisory/ntap-20220915-0003/ Third Party Advisory
https://support.apple.com/kb/HT213488 Third Party Advisory
https://www.debian.org/security/2022/dsa-5197 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:h:siemens:scalance_sc622-2c:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc622-2c_firmware:*:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:h:siemens:scalance_sc626-2c:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc626-2c_firmware:*:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:siemens:scalance_sc632-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_sc632-2c:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:siemens:scalance_sc636-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_sc636-2c:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:siemens:scalance_sc642-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_sc642-2c:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:siemens:scalance_sc646-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_sc646-2c:-:*:*:*:*:*:*:*

Configuration 16 (hide)

OR cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
History

27 Mar 2024, 15:00

Type Values Removed Values Added
CPE cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
First Time Splunk
Splunk universal Forwarder
References () http://www.openwall.com/lists/oss-security/2023/02/15/3 - () http://www.openwall.com/lists/oss-security/2023/02/15/3 - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ - Mailing List, Third Party Advisory

07 Nov 2023, 03:47

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/', 'name': 'FEDORA-2022-1b3d7f6973', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ -

15 Feb 2023, 10:15

Type Values Removed Values Added
References
  • (MLIST) http://www.openwall.com/lists/oss-security/2023/02/15/3 -

05 Jan 2023, 17:46

Type Values Removed Values Added
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf - Patch, Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/202212-01 - (GENTOO) https://security.gentoo.org/glsa/202212-01 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2022/Oct/28 - (FULLDISC) http://seclists.org/fulldisclosure/2022/Oct/28 - Mailing List, Third Party Advisory
First Time Siemens scalance Sc622-2c
Siemens scalance Sc636-2c Firmware
Siemens scalance Sc632-2c
Siemens scalance Sc626-2c Firmware
Siemens scalance Sc632-2c Firmware
Siemens scalance Sc626-2c
Siemens scalance Sc642-2c
Siemens scalance Sc646-2c
Siemens scalance Sc622-2c Firmware
Siemens scalance Sc642-2c Firmware
Siemens
Siemens scalance Sc646-2c Firmware
Siemens scalance Sc636-2c
CPE cpe:2.3:h:siemens:scalance_sc636-2c:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc642-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc636-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_sc642-2c:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_sc622-2c:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_sc646-2c:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc626-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc646-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_sc626-2c:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc632-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_sc632-2c:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc622-2c_firmware:*:*:*:*:*:*:*:*

19 Dec 2022, 04:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202212-01 -

13 Dec 2022, 12:15

Type Values Removed Values Added
References
  • (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf -
  • (FULLDISC) http://seclists.org/fulldisclosure/2022/Oct/28 -

08 Dec 2022, 03:32

Type Values Removed Values Added
References (FULLDISC) http://seclists.org/fulldisclosure/2022/Oct/41 - (FULLDISC) http://seclists.org/fulldisclosure/2022/Oct/41 - Mailing List, Third Party Advisory

30 Oct 2022, 23:15

Type Values Removed Values Added
References
  • (FULLDISC) http://seclists.org/fulldisclosure/2022/Oct/41 -

27 Oct 2022, 16:13

Type Values Removed Values Added
First Time Netapp element Software
Fedoraproject fedora
Netapp h500s
Netapp solidfire
Netapp clustered Data Ontap
Netapp h410s Firmware
Debian
Netapp hci Management Node
Netapp h700s
Netapp h300s
Fedoraproject
Netapp bootstrap Os
Debian debian Linux
Netapp
Netapp h300s Firmware
Netapp hci Compute Node
Netapp h700s Firmware
Netapp h410s
Netapp h500s Firmware
CPE cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
References (CONFIRM) https://support.apple.com/kb/HT213488 - (CONFIRM) https://support.apple.com/kb/HT213488 - Third Party Advisory
References (DEBIAN) https://www.debian.org/security/2022/dsa-5197 - (DEBIAN) https://www.debian.org/security/2022/dsa-5197 - Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ - Mailing List, Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20220915-0003/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20220915-0003/ - Third Party Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html - (MLIST) https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html - Mailing List, Third Party Advisory

25 Oct 2022, 21:15

Type Values Removed Values Added
References
  • (CONFIRM) https://support.apple.com/kb/HT213488 -

15 Sep 2022, 18:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20220915-0003/ -

29 Aug 2022, 01:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html -

02 Aug 2022, 03:15

Type Values Removed Values Added
References
  • (DEBIAN) https://www.debian.org/security/2022/dsa-5197 -

15 Jul 2022, 03:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ -

14 Jul 2022, 17:37

Type Values Removed Values Added
CPE cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
First Time Haxx curl
Haxx
CVSS v2 : unknown
v3 : unknown 		v2 : 4.3
v3 : 6.5
CWE CWE-770
References (MISC) https://hackerone.com/reports/1570651 - (MISC) https://hackerone.com/reports/1570651 - Exploit, Third Party Advisory

07 Jul 2022, 13:17

Type Values Removed Values Added
New CVE
Information

Published : 2022-07-07 13:15

Updated : 2024-03-27 15:00

NVD link : CVE-2022-32206

Mitre link : CVE-2022-32206

CVE.ORG link : CVE-2022-32206

JSON object : View

Products Affected

netapp

  • h700s_firmware
  • solidfire
  • h410s
  • h300s
  • h700s
  • element_software
  • hci_compute_node
  • h410s_firmware
  • h500s
  • bootstrap_os
  • clustered_data_ontap
  • h300s_firmware
  • hci_management_node
  • h500s_firmware

splunk

  • universal_forwarder

siemens

  • scalance_sc636-2c
  • scalance_sc646-2c
  • scalance_sc626-2c_firmware
  • scalance_sc632-2c
  • scalance_sc642-2c
  • scalance_sc622-2c
  • scalance_sc626-2c
  • scalance_sc636-2c_firmware
  • scalance_sc642-2c_firmware
  • scalance_sc632-2c_firmware
  • scalance_sc646-2c_firmware
  • scalance_sc622-2c_firmware

debian

  • debian_linux

fedoraproject

  • fedora

haxx

  • curl
CWE
CWE-770

Allocation of Resources Without Limits or Throttling