CVE-2022-27774
Publication date 27 April 2022
Last updated 24 July 2024
Ubuntu priority
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| curl | 22.04 LTS jammy |
Fixed 7.81.0-1ubuntu1.1
|
| 20.04 LTS focal |
Fixed 7.68.0-1ubuntu2.10
|
|
| 18.04 LTS bionic |
Fixed 7.58.0-2ubuntu3.17
|
|
| 16.04 LTS xenial | Ignored regressions likely | |
| 14.04 LTS trusty | Ignored end of ESM support, was ignored [regressions likely] |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.7 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-5397-1
- curl vulnerabilities
- 28 April 2022