CVE-2022-27782 - log back

CVE-2022-27782 edited at 11 May 2022 11:15:17
References
- https://seclists.org/oss-sec/2022/q2/94
+ https://seclists.org/oss-sec/2022/q2/96
https://curl.se/docs/CVE-2022-27782.html
https://github.com/curl/curl/commit/f18af4f874
https://github.com/curl/curl/commit/1645e9b44505abd5cbaf65da5282c3f33b5924a5
CVE-2022-27782 edited at 11 May 2022 10:59:44
Severity
- Unknown
+ Medium
Description
+ libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several TLS and SSH settings were left out from the configuration match checks, making them match too easily.
References
+ https://seclists.org/oss-sec/2022/q2/94
+ https://curl.se/docs/CVE-2022-27782.html
+ https://github.com/curl/curl/commit/f18af4f874
+ https://github.com/curl/curl/commit/1645e9b44505abd5cbaf65da5282c3f33b5924a5
Notes
+ Affected versions: curl 7.16.1 to and including 7.83.0
+ Not affected versions: curl < 7.16.1 and curl >= 7.83.1
CVE-2022-27782 created at 11 May 2022 10:34:34
Severity
+ Unknown
Remote
+ Unknown
Type
+ Unknown
Description
References
Notes