Logo
›
›vulnerability›CVE-2022-42916
Name
CVE-2022-42916
Source
NVD ( link)Debian ( link)
Description
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.
CWEs
CWE-319 CWE-319
Published Date
Updated Date
Workaround
-
Advisories
http://seclists.org/fulldisclosure/2023/Jan/19Mailing List
http://seclists.org/fulldisclosure/2023/Jan/20Mailing List
http://www.openwall.com/lists/oss-security/2022/12/21/1Mailing List
https://curl.se/docs/CVE-2022-42916.htmlVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/Mailing List
https://security.gentoo.org/glsa/202212-01Third Party Advisory
https://security.netapp.com/advisory/ntap-20221209-0010/Broken Link
https://support.apple.com/kb/HT213604Third Party Advisory
https://support.apple.com/kb/HT213605Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jan/19Mailing List
http://seclists.org/fulldisclosure/2023/Jan/20Mailing List
http://www.openwall.com/lists/oss-security/2022/12/21/1Mailing List
https://curl.se/docs/CVE-2022-42916.htmlVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/Mailing List
https://security.gentoo.org/glsa/202212-01Third Party Advisory
https://security.netapp.com/advisory/ntap-20221209-0010/Broken Link
https://support.apple.com/kb/HT213604Third Party Advisory
https://support.apple.com/kb/HT213605Third Party Advisory

Analysis#

Affected Component
Analysis
curl
Patched

Vulnerability Ratings#

7.5
CVSSv31
7.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
libcurl
buildroot
2025.02.x
8.20.0
Not Affected
libcurl
buildroot
master
8.21.0
Not Affected
curl
openwrt
master
8.19.0-r2
Not Affected
libcurl-gnutls
openwrt
master
8.20.0-r1
Not Affected
curl
openwrt
openwrt-25.12
8.19.0-r2
Not Affected
libcurl-gnutls
openwrt
openwrt-25.12
8.14.1-r1
Not Affected
curl
yocto
master
8.20.0
Not Affected
curl
yocto
scarthgap
8.7.1
Not Affected

Resolved with patches#

curl (yocto:kirkstone)

#
Title
Author
Resolve
1
url: use IDN decoded names for HSTS checks
Daniel Stenberg <daniel@haxx.se>
CVE-2022-42916