CVE-2022-27782 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Medium
Remote	Unknown
Type	Unknown
Description	libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several TLS and SSH settings were left out from the configuration match checks, making them match too easily.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-2706	curl	7.83.0-1	7.83.1-1	Medium	Fixed

References
https://seclists.org/oss-sec/2022/q2/96 https://curl.se/docs/CVE-2022-27782.html https://github.com/curl/curl/commit/f18af4f874 https://github.com/curl/curl/commit/1645e9b44505abd5cbaf65da5282c3f33b5924a5

References

https://seclists.org/oss-sec/2022/q2/96
https://curl.se/docs/CVE-2022-27782.html
https://github.com/curl/curl/commit/f18af4f874
https://github.com/curl/curl/commit/1645e9b44505abd5cbaf65da5282c3f33b5924a5

Notes
Affected versions: curl 7.16.1 to and including 7.83.0 Not affected versions: curl < 7.16.1 and curl >= 7.83.1