<p>Upgrade <code>Alpine:3.16</code> <code>curl</code> to version 7.83.1-r4 or higher.</p>

Double Free Affecting curl package, versions <7.83.1-r4

Threat Intelligence

0.92% (84^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-ALPINE316-CURL-3063712
published 26 Oct 2022
disclosed 29 Oct 2022

Report a new vulnerability Found a mistake?

Introduced: 26 Oct 2022

CVE-2022-42915 Open this link in a new tab CWE-415 Open this link in a new tab

How to fix?

Upgrade Alpine:3.16 curl to version 7.83.1-r4 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Alpine. See How to fix? for Alpine:3.16 relevant fixed versions and status.

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

High
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

High
Integrity (I)

High
Availability (A)

High