kritisch
CVE-2022-32207
curl: Unpreserved file permissions
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, CBL-Mariner, Julia, Photon OS. Niedriger laut Red Hat (mittel), AlmaLinux (mittel), Amazon (mittel), Oracle (mittel), Rocky Linux (mittel), Ubuntu (mittel).
Beschreibung
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| CBL-Mariner 1.0 | curl | 0:7.84.0-1.cm1 |
| CBL-Mariner 2.0 | curl | 0:7.84.0-1.cm2 |
| julia::Julia Ecosystem Security Advisories | CURL_jll, LibCURL_jll | 8.5.0+0 und 1 weitere |
| Photon OS 2.0 | curl | 7.83.1-2.ph2 |
| Photon OS 3.0 | curl | 7.83.1-2.ph3 |
| Photon OS 4.0 | curl, curl-devel, curl-libs | 7.83.1-2.ph4 |
| alma 9 | curl, curl-minimal, libcurl und 2 weitere | 7.76.1-14.el9_0.5 |
| alpine 3.13 | curl | 7.79.1-r2 |
| alpine 3.14 | curl | 7.79.1-r2 |
| alpine 3.15 | curl | 7.80.0-r2 |
| alpine 3.16 | curl | 7.83.1-r2 |
| alpine 3.17 | curl | 7.84.0-r0 |
Alle 89 Einträge aus 42 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| CBL-Mariner 1.0 | curl | 0:7.84.0-1.cm1 |
| CBL-Mariner 2.0 | curl | 0:7.84.0-1.cm2 |
| julia::Julia Ecosystem Security Advisories | CURL_jll | 8.5.0+0 |
| julia::Julia Ecosystem Security Advisories | LibCURL_jll | 7.84.0+0 |
| Photon OS 2.0 | curl | 7.83.1-2.ph2 |
| Photon OS 3.0 | curl | 7.83.1-2.ph3 |
| Photon OS 4.0 | curl | 7.83.1-2.ph4 |
| Photon OS 4.0 | curl-devel | 7.83.1-2.ph4 |
| Photon OS 4.0 | curl-libs | 7.83.1-2.ph4 |
| alma 9 | curl | 7.76.1-14.el9_0.5 |
| alma 9 | curl-minimal | 7.76.1-14.el9_0.5 |
| alma 9 | libcurl | 7.76.1-14.el9_0.5 |
| alma 9 | libcurl-devel | 7.76.1-14.el9_0.5 |
| alma 9 | libcurl-minimal | 7.76.1-14.el9_0.5 |
| alpine 3.13 | curl | 7.79.1-r2 |
| alpine 3.14 | curl | 7.79.1-r2 |
| alpine 3.15 | curl | 7.80.0-r2 |
| alpine 3.16 | curl | 7.83.1-r2 |
| alpine 3.17 | curl | 7.84.0-r0 |
| alpine 3.18 | curl | 7.84.0-r0 |
| alpine 3.19 | curl | 7.84.0-r0 |
| alpine 3.20 | curl | 7.84.0-r0 |
| alpine 3.21 | curl | 7.84.0-r0 |
| alpine 3.22 | curl | 7.84.0-r0 |
| alpine 3.23 | curl | 7.84.0-r0 |
| alpine 3.24 | curl | 7.84.0-r0 |
| alpine edge | curl | 7.84.0-r0 |
| amazon linux 2 | curl | 7.79.1-6.amzn2.0.1 |
| amazon linux 2 | curl-debuginfo | 7.79.1-6.amzn2.0.1 |
| amazon linux 2 | libcurl | 7.79.1-6.amzn2.0.1 |
| amazon linux 2 | libcurl-devel | 7.79.1-6.amzn2.0.1 |
| amazon linux 2022 | curl | 7.85.0-1.amzn2022.0.1 |
| amazon linux 2022 | curl-debuginfo | 7.85.0-1.amzn2022.0.1 |
| amazon linux 2022 | curl-debugsource | 7.85.0-1.amzn2022.0.1 |
| amazon linux 2022 | curl-minimal | 7.85.0-1.amzn2022.0.1 |
| amazon linux 2022 | curl-minimal-debuginfo | 7.85.0-1.amzn2022.0.1 |
| amazon linux 2022 | libcurl | 7.85.0-1.amzn2022.0.1 |
| amazon linux 2022 | libcurl-debuginfo | 7.85.0-1.amzn2022.0.1 |
| amazon linux 2022 | libcurl-devel | 7.85.0-1.amzn2022.0.1 |
| amazon linux 2022 | libcurl-minimal | 7.85.0-1.amzn2022.0.1 |
| amazon linux 2022 | libcurl-minimal-debuginfo | 7.85.0-1.amzn2022.0.1 |
| amazon linux 2023 | curl | 7.87.0-2.amzn2023.0.2 |
| amazon linux 2023 | curl-debuginfo | 7.87.0-2.amzn2023.0.2 |
| amazon linux 2023 | curl-debugsource | 7.87.0-2.amzn2023.0.2 |
| amazon linux 2023 | curl-minimal | 7.87.0-2.amzn2023.0.2 |
| amazon linux 2023 | curl-minimal-debuginfo | 7.87.0-2.amzn2023.0.2 |
| amazon linux 2023 | libcurl | 7.87.0-2.amzn2023.0.2 |
| amazon linux 2023 | libcurl-debuginfo | 7.87.0-2.amzn2023.0.2 |
| amazon linux 2023 | libcurl-devel | 7.87.0-2.amzn2023.0.2 |
| amazon linux 2023 | libcurl-minimal | 7.87.0-2.amzn2023.0.2 |
| amazon linux 2023 | libcurl-minimal-debuginfo | 7.87.0-2.amzn2023.0.2 |
| debian 11 | curl | 7.74.0-1.3+deb11u2 |
| debian 12 | curl | 7.84.0-1 |
| debian 13 | curl | 7.84.0-1 |
| debian 14 | curl | 7.84.0-1 |
| echo | curl | 7.84.0-1 |
| echo | curl-7.69.1 | 7.69.1+e1 |
| Oracle Linux 9 | curl | 7.76.1-14.el9_0.5 |
| Oracle Linux 9 | curl-minimal | 7.76.1-14.el9_0.5 |
| Oracle Linux 9 | libcurl | 7.76.1-14.el9_0.5 |
| Oracle Linux 9 | libcurl-devel | 7.76.1-14.el9_0.5 |
| Oracle Linux 9 | libcurl-minimal | 7.76.1-14.el9_0.5 |
| rapidfort Oracle Linux 9 | curl | 0:7.76.1-14.el9_0.5 |
| rapidfort Oracle Linux 9 | curl-minimal | 0:7.76.1-14.el9_0.5 |
| rapidfort Oracle Linux 9 | libcurl | 0:7.76.1-14.el9_0.5 |
| rapidfort Oracle Linux 9 | libcurl-devel | 0:7.76.1-14.el9_0.5 |
| rapidfort Oracle Linux 9 | libcurl-minimal | 0:7.76.1-14.el9_0.5 |
| rapidfort ubuntu 20.04 | curl | 0:7.81.0-1ubuntu1.3 |
| rapidfort ubuntu 20.04 | rf-curl | 0:7.81.0-1ubuntu1.3 |
| rapidfort ubuntu 22.04 | curl | 0:7.81.0-1ubuntu1.3 |
| rapidfort ubuntu 22.04 | rf-curl | 0:7.81.0-1ubuntu1.3 |
| rapidfort ubuntu 24.04 | curl | 0:7.81.0-1ubuntu1.3 |
| rapidfort ubuntu 24.04 | rf-curl | 0:7.81.0-1ubuntu1.3 |
| Red Hat | httpd24-curl | kein Fix angegeben |
| Red Hat | httpd24-libcurl | kein Fix angegeben |
| Red Hat | httpd24-libcurl-devel | kein Fix angegeben |
| rocky 9 | curl | 7.76.1-14.el9_0.5 |
| rocky 9 | curl-minimal | 7.76.1-14.el9_0.5 |
| rocky 9 | libcurl | 7.76.1-14.el9_0.5 |
| rocky 9 | libcurl-devel | 7.76.1-14.el9_0.5 |
| rocky 9 | libcurl-minimal | 7.76.1-14.el9_0.5 |
| root.io debian 11 | rootio-curl | 7.74.0-1.3+deb11u2 |
| root.io debian 12 | rootio-curl | 7.84.0-1 |
| root.io debian 13 | rootio-curl | 7.84.0-1 |
| seal Red Hat 8 | curl | 7.61.1-34.el8_10.3+sp999 |
| seal Red Hat 8 | seal-curl | 7.61.1-34.el8_10.3+sp999 |
| ubuntu 21.10 | curl | 7.74.0-1.3ubuntu2.3 |
| ubuntu 22.04 | curl | 7.81.0-1ubuntu1.3 |
| ubuntu 22.10 | curl | 7.84.0-1 |
Referenzen
- http://seclists.org/fulldisclosure/2022/Oct/28
- http://seclists.org/fulldisclosure/2022/Oct/41
- https://access.redhat.com/errata/RHSA-2022:6157
- https://access.redhat.com/security/cve/CVE-2022-32207
- https://bugzilla.redhat.com/2099300
- https://bugzilla.redhat.com/2099305
- https://bugzilla.redhat.com/2099306
- https://bugzilla.redhat.com/show_bug.cgi?id=2099300
Alle 33 Referenzen
- https://bugzilla.redhat.com/show_bug.cgi?id=2099305
- https://bugzilla.redhat.com/show_bug.cgi?id=2099306
- https://cert-portal.siemens.com/productcert/html/ssa-146325.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-419740.html
- https://cert-portal.siemens.com/productcert/html/ssa-558014.html
- https://cert-portal.siemens.com/productcert/html/ssa-942865.html
- https://creativecommons.org/licenses/by/4.0/
- https://curl.se/docs/CVE-2022-32207.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32206
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32207
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32208
- https://errata.almalinux.org/9/ALSA-2022-6157.html
- https://errata.rockylinux.org/RLSA-2022:6157
- https://hackerone.com/reports/1573634
- https://linux.oracle.com/cve/CVE-2022-32207.html
- https://linux.oracle.com/errata/ELSA-2022-6157.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
- https://nvd.nist.gov/vuln/detail/CVE-2022-32207
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20220915-0003/
- https://support.apple.com/kb/HT213488
- https://ubuntu.com/security/notices/USN-5495-1
- https://www.cve.org/CVERecord?id=CVE-2022-32207
- https://www.debian.org/security/2022/dsa-5197