CVE Vulnerabilities

CVE-2022-27776

Insufficiently Protected Credentials

Published: Jun 02, 2022 | Modified: Mar 27, 2024
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
4.3 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Ubuntu
LOW

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

Weakness

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected Software

Name Vendor Start Version End Version
Curl Haxx * 7.83.0 (excluding)
Red Hat Enterprise Linux 8 RedHat curl-0:7.61.1-22.el8_6.3 *
Red Hat Enterprise Linux 9 RedHat curl-0:7.76.1-14.el9_0.4 *
Red Hat Enterprise Linux 9 RedHat curl-0:7.76.1-14.el9_0.4 *
Curl Ubuntu bionic *
Curl Ubuntu devel *
Curl Ubuntu esm-infra/bionic *
Curl Ubuntu esm-infra/xenial *
Curl Ubuntu focal *
Curl Ubuntu impish *
Curl Ubuntu jammy *
Curl Ubuntu trusty/esm *
Curl Ubuntu upstream *

Potential Mitigations

References