CURL-CVE-2022-27775
See a problem?- Source
- https://curl.se/docs/CVE-2022-27775.html
- Import Source
- https://curl.se/docs/CURL-CVE-2022-27775.json
- JSON Data
- https://api.osv.dev/v1/vulns/CURL-CVE-2022-27775
- Aliases
- Published
- 2022-04-27T08:00:00Z
- Modified
- 2024-06-07T13:53:51Z
- Summary
- Bad local IPv6 connection reuse
- Details
-
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup.
Due to errors in the logic, the config matching function did not take the IPv6 address zone id into account which could lead to libcurl reusing the wrong connection when one transfer uses a zone id and a subsequent transfer uses another (or no) zone id.
- References
-
- Credits
-
-
- Harry Sintonen - FINDER
-
- Daniel Stenberg - REMEDIATION_DEVELOPER
-