CVE-2022-42915 (CNNVD-202210-2217)

HIGH
中文标题:
curl 资源管理错误漏洞
英文标题:
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non...
CVSS分数: 8.1
发布时间: 2022-10-29 00:00:00
漏洞类型: 资源管理错误
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

curl是一款用于从服务器传输数据或向服务器传输数据的工具。 curl存在安全漏洞，该漏洞源于错误/清理处理中存在问题，如果使用HTTP代理进行具有非HTTP(S) URL的传输，则会导致双重释放。

英文描述:

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.

CWE类型:
CWE-415
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
haxx curl * - - cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
fedoraproject fedora 35 - - cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
fedoraproject fedora 36 - - cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
fedoraproject fedora 37 - - cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
netapp h300s_firmware - - - cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
netapp h500s_firmware - - - cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
netapp h700s_firmware - - - cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
netapp h410s_firmware - - - cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
netapp ontap_9 - - - cpe:2.3:a:netapp:ontap_9:-:*:*:*:*:*:*:*
apple macos * - - cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
splunk universal_forwarder * - - cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
splunk universal_forwarder 9.1.0 - - cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
无标题 OTHER
cve.org
访问
FEDORA-2022-01ffde372c vendor-advisory
cve.org
访问
FEDORA-2022-39688a779d vendor-advisory
cve.org
访问
FEDORA-2022-e9d65906c4 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
GLSA-202212-01 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
20230123 APPLE-SA-2023-01-23-5 macOS Monterey 12.6.3 mailing-list
cve.org
访问
20230123 APPLE-SA-2023-01-23-4 macOS Ventura 13.2 mailing-list
cve.org
访问
CVSS评分详情
3.1 (adp)
HIGH
8.1
CVSS向量: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
机密性
HIGH
完整性
HIGH
可用性
HIGH
时间信息
发布时间:
2022-10-29 00:00:00
修改时间:
2025-05-07 13:59:25
创建时间:
2025-11-11 15:37:48
更新时间:
2025-11-11 15:57:35
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2022-42915 2025-11-11 15:21:37 2025-11-11 07:37:48
NVD nvd_CVE-2022-42915 2025-11-11 14:58:27 2025-11-11 07:45:59
CNNVD cnnvd_CNNVD-202210-2217 2025-11-11 15:11:02 2025-11-11 07:57:35
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:57:35
vulnerability_type: 未提取 → 资源管理错误; cnnvd_id: 未提取 → CNNVD-202210-2217; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 资源管理错误
  • cnnvd_id: 未提取 -> CNNVD-202210-2217
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:45:59
affected_products_count: 0 → 12; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • affected_products_count: 0 -> 12
  • data_sources: ['cve'] -> ['cve', 'nvd']