Logo
›
›vulnerability›CVE-2022-35252
Name
CVE-2022-35252
Source
NVD ( link)Debian ( link)
Description
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
CWEs
CWE-20
Published Date
Updated Date
Workaround
-
Advisories
http://seclists.org/fulldisclosure/2023/Jan/20Mailing List
http://seclists.org/fulldisclosure/2023/Jan/21Mailing List
https://hackerone.com/reports/1613943Exploit
https://lists.debian.org/debian-lts-announce/2023/01/msg00028.htmlMailing List
https://security.gentoo.org/glsa/202212-01Third Party Advisory
https://security.netapp.com/advisory/ntap-20220930-0005/Third Party Advisory
https://support.apple.com/kb/HT213603Third Party Advisory
https://support.apple.com/kb/HT213604Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jan/20Mailing List
http://seclists.org/fulldisclosure/2023/Jan/21Mailing List
https://hackerone.com/reports/1613943Exploit
https://lists.debian.org/debian-lts-announce/2023/01/msg00028.htmlMailing List
https://security.gentoo.org/glsa/202212-01Third Party Advisory
https://security.netapp.com/advisory/ntap-20220930-0005/Third Party Advisory
https://support.apple.com/kb/HT213603Third Party Advisory
https://support.apple.com/kb/HT213604Third Party Advisory

Analysis#

Affected Component
Analysis
curl
Exploitable

Vulnerability Ratings#

3.7
CVSSv31
3.7
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
libcurl
buildroot
2025.02.x
8.20.0
Not Affected
libcurl
buildroot
master
8.21.0
Not Affected
curl
openwrt
master
8.19.0-r2
Not Affected
libcurl-gnutls
openwrt
master
8.20.0-r1
Not Affected
curl
openwrt
openwrt-25.12
8.19.0-r2
Not Affected
libcurl-gnutls
openwrt
openwrt-25.12
8.14.1-r1
Not Affected
curl
yocto
master
8.20.0
Not Affected
curl
yocto
scarthgap
8.7.1
Not Affected