CVE Vulnerabilities

CVE-2022-27781

Loop with Unreachable Exit Condition ('Infinite Loop')

Published: Jun 02, 2022 | Modified: Mar 27, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
7.5 LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
LOW

libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a servers certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name Vendor Start Version End Version
Curl Haxx * 7.83.1 (excluding)
JBoss Core Services for RHEL 8 RedHat jbcs-httpd24-curl-0:7.86.0-2.el8jbcs *
JBoss Core Services on RHEL 7 RedHat jbcs-httpd24-curl-0:7.86.0-2.el7jbcs *
Red Hat JBoss Core Services 1 RedHat curl *
Curl Ubuntu bionic *
Curl Ubuntu devel *
Curl Ubuntu esm-infra/bionic *
Curl Ubuntu esm-infra/xenial *
Curl Ubuntu focal *
Curl Ubuntu impish *
Curl Ubuntu jammy *
Curl Ubuntu trusty/esm *
Curl Ubuntu upstream *

References