CVE-2022-30115

Updated: 2023-11-04 20:04:19.820782

Description:

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x MEDIUM 4
CVSS Version 3.x MEDIUM 4.3

Status

OS name Project name Version Score Severity Status Errata Last updated
CentOS 6 ELS curl 7.19.7 4.3 MEDIUM Ignored 2022-06-14 06:30:36
CentOS 8.4 ELS curl 7.61.1 4.3 MEDIUM Ignored 2022-06-14 06:30:36
CentOS 8.5 ELS curl 7.61.1 4.3 MEDIUM Ignored 2022-06-14 06:30:36
CloudLinux 6 ELS curl 7.19.7 4.3 MEDIUM Ignored 2022-06-14 06:30:36
Oracle Linux 6 ELS curl 7.19.7 4.3 MEDIUM Ignored 2022-06-14 06:30:36
Ubuntu 16.04 ELS curl 7.47.0 4.3 MEDIUM Ignored 2022-06-14 06:30:36