Homepage

Cleartext Transmission of Sensitive Information The advisory has been revoked - it doesn't affect any version of package libcurl-devel  (opens in a new tab)

Threat Intelligence

EPSS
0.18% (56th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-LIBCURLDEVEL-3086261
  • published27 Oct 2022
  • disclosed26 Oct 2022
Report a new vulnerability Found a mistake?

Introduced: 26 Oct 2022

CVE-2022-42916  (opens in a new tab)
CWE-319  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl-devel package and not the libcurl-devel package as distributed by RHEL.

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.

References