csaf_suse - suse-su-2022:3785-1

Vulnerability from csaf_suse

Published

2022-10-26 18:20

Modified

2022-10-26 18:20

Summary

Security update for curl

Notes

Title of the patch

Security update for curl

Description of the patch

This update for curl fixes the following issues: - CVE-2022-32221: Fixed POST following PUT confusion (bsc#1204383). - CVE-2022-42916: Fixed HSTS bypass via IDN (bsc#1204386).

Patchnames

SUSE-2022-3785,SUSE-SLE-Micro-5.3-2022-3785,SUSE-SLE-Module-Basesystem-15-SP4-2022-3785,openSUSE-SLE-15.4-2022-3785

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for curl",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for curl fixes the following issues:\n\n  - CVE-2022-32221: Fixed POST following PUT confusion (bsc#1204383).\n  - CVE-2022-42916: Fixed HSTS bypass via IDN (bsc#1204386).\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2022-3785,SUSE-SLE-Micro-5.3-2022-3785,SUSE-SLE-Module-Basesystem-15-SP4-2022-3785,openSUSE-SLE-15.4-2022-3785",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3785-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2022:3785-1",
            url: "https://www.suse.com/support/update/announcement/2022/suse-su-20223785-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2022:3785-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012718.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1204383",
            url: "https://bugzilla.suse.com/1204383",
         },
         {
            category: "self",
            summary: "SUSE Bug 1204386",
            url: "https://bugzilla.suse.com/1204386",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-32221 page",
            url: "https://www.suse.com/security/cve/CVE-2022-32221/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-42916 page",
            url: "https://www.suse.com/security/cve/CVE-2022-42916/",
         },
      ],
      title: "Security update for curl",
      tracking: {
         current_release_date: "2022-10-26T18:20:29Z",
         generator: {
            date: "2022-10-26T18:20:29Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2022:3785-1",
         initial_release_date: "2022-10-26T18:20:29Z",
         revision_history: [
            {
               date: "2022-10-26T18:20:29Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "curl-7.79.1-150400.5.9.1.aarch64",
                        product: {
                           name: "curl-7.79.1-150400.5.9.1.aarch64",
                           product_id: "curl-7.79.1-150400.5.9.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                        product: {
                           name: "libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                           product_id: "libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl4-7.79.1-150400.5.9.1.aarch64",
                        product: {
                           name: "libcurl4-7.79.1-150400.5.9.1.aarch64",
                           product_id: "libcurl4-7.79.1-150400.5.9.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libcurl-devel-64bit-7.79.1-150400.5.9.1.aarch64_ilp32",
                        product: {
                           name: "libcurl-devel-64bit-7.79.1-150400.5.9.1.aarch64_ilp32",
                           product_id: "libcurl-devel-64bit-7.79.1-150400.5.9.1.aarch64_ilp32",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl4-64bit-7.79.1-150400.5.9.1.aarch64_ilp32",
                        product: {
                           name: "libcurl4-64bit-7.79.1-150400.5.9.1.aarch64_ilp32",
                           product_id: "libcurl4-64bit-7.79.1-150400.5.9.1.aarch64_ilp32",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64_ilp32",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "curl-7.79.1-150400.5.9.1.i586",
                        product: {
                           name: "curl-7.79.1-150400.5.9.1.i586",
                           product_id: "curl-7.79.1-150400.5.9.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl-devel-7.79.1-150400.5.9.1.i586",
                        product: {
                           name: "libcurl-devel-7.79.1-150400.5.9.1.i586",
                           product_id: "libcurl-devel-7.79.1-150400.5.9.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl4-7.79.1-150400.5.9.1.i586",
                        product: {
                           name: "libcurl4-7.79.1-150400.5.9.1.i586",
                           product_id: "libcurl4-7.79.1-150400.5.9.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "curl-7.79.1-150400.5.9.1.ppc64le",
                        product: {
                           name: "curl-7.79.1-150400.5.9.1.ppc64le",
                           product_id: "curl-7.79.1-150400.5.9.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                        product: {
                           name: "libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                           product_id: "libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl4-7.79.1-150400.5.9.1.ppc64le",
                        product: {
                           name: "libcurl4-7.79.1-150400.5.9.1.ppc64le",
                           product_id: "libcurl4-7.79.1-150400.5.9.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "curl-7.79.1-150400.5.9.1.s390x",
                        product: {
                           name: "curl-7.79.1-150400.5.9.1.s390x",
                           product_id: "curl-7.79.1-150400.5.9.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl-devel-7.79.1-150400.5.9.1.s390x",
                        product: {
                           name: "libcurl-devel-7.79.1-150400.5.9.1.s390x",
                           product_id: "libcurl-devel-7.79.1-150400.5.9.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl4-7.79.1-150400.5.9.1.s390x",
                        product: {
                           name: "libcurl4-7.79.1-150400.5.9.1.s390x",
                           product_id: "libcurl4-7.79.1-150400.5.9.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "curl-7.79.1-150400.5.9.1.x86_64",
                        product: {
                           name: "curl-7.79.1-150400.5.9.1.x86_64",
                           product_id: "curl-7.79.1-150400.5.9.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                        product: {
                           name: "libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                           product_id: "libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
                        product: {
                           name: "libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
                           product_id: "libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl4-7.79.1-150400.5.9.1.x86_64",
                        product: {
                           name: "libcurl4-7.79.1-150400.5.9.1.x86_64",
                           product_id: "libcurl4-7.79.1-150400.5.9.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                        product: {
                           name: "libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                           product_id: "libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Micro 5.3",
                        product: {
                           name: "SUSE Linux Enterprise Micro 5.3",
                           product_id: "SUSE Linux Enterprise Micro 5.3",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-micro:5.3",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                        product: {
                           name: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                           product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-basesystem:15:sp4",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.4",
                        product: {
                           name: "openSUSE Leap 15.4",
                           product_id: "openSUSE Leap 15.4",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.4",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
               product_id: "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.aarch64",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Micro 5.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
               product_id: "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.s390x",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Micro 5.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
               product_id: "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Micro 5.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
               product_id: "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.aarch64",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Micro 5.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
               product_id: "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.s390x",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Micro 5.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
               product_id: "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Micro 5.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.aarch64",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.ppc64le",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.s390x",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl-devel-7.79.1-150400.5.9.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
            },
            product_reference: "libcurl-devel-7.79.1-150400.5.9.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl-devel-7.79.1-150400.5.9.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
            },
            product_reference: "libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl-devel-7.79.1-150400.5.9.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
            },
            product_reference: "libcurl-devel-7.79.1-150400.5.9.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl-devel-7.79.1-150400.5.9.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "libcurl-devel-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.aarch64",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.s390x",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-32bit-7.79.1-150400.5.9.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.aarch64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.aarch64",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.ppc64le as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.ppc64le",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.s390x as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.s390x",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "curl-7.79.1-150400.5.9.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "curl-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl-devel-7.79.1-150400.5.9.1.aarch64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
            },
            product_reference: "libcurl-devel-7.79.1-150400.5.9.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl-devel-7.79.1-150400.5.9.1.ppc64le as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
            },
            product_reference: "libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl-devel-7.79.1-150400.5.9.1.s390x as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
            },
            product_reference: "libcurl-devel-7.79.1-150400.5.9.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl-devel-7.79.1-150400.5.9.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "libcurl-devel-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.aarch64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.aarch64",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.ppc64le as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.s390x as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.s390x",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-7.79.1-150400.5.9.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "libcurl4-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libcurl4-32bit-7.79.1-150400.5.9.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
            },
            product_reference: "libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2022-32221",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-32221",
            },
         ],
         notes: [
            {
               category: "general",
               text: "When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.aarch64",
               "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.s390x",
               "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.x86_64",
               "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.aarch64",
               "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.s390x",
               "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.x86_64",
               "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.aarch64",
               "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.ppc64le",
               "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.s390x",
               "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.x86_64",
               "openSUSE Leap 15.4:libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
               "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
               "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
               "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
               "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
               "openSUSE Leap 15.4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
               "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.aarch64",
               "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
               "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.s390x",
               "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-32221",
               url: "https://www.suse.com/security/cve/CVE-2022-32221",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204383 for CVE-2022-32221",
               url: "https://bugzilla.suse.com/1204383",
            },
            {
               category: "external",
               summary: "SUSE Bug 1205287 for CVE-2022-32221",
               url: "https://bugzilla.suse.com/1205287",
            },
            {
               category: "external",
               summary: "SUSE Bug 1205834 for CVE-2022-32221",
               url: "https://bugzilla.suse.com/1205834",
            },
            {
               category: "external",
               summary: "SUSE Bug 1206236 for CVE-2022-32221",
               url: "https://bugzilla.suse.com/1206236",
            },
            {
               category: "external",
               summary: "SUSE Bug 1208340 for CVE-2022-32221",
               url: "https://bugzilla.suse.com/1208340",
            },
            {
               category: "external",
               summary: "SUSE Bug 1211233 for CVE-2022-32221",
               url: "https://bugzilla.suse.com/1211233",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-10-26T18:20:29Z",
               details: "important",
            },
         ],
         title: "CVE-2022-32221",
      },
      {
         cve: "CVE-2022-42916",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-42916",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.aarch64",
               "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.s390x",
               "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.x86_64",
               "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.aarch64",
               "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.s390x",
               "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.x86_64",
               "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.aarch64",
               "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.ppc64le",
               "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.s390x",
               "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.x86_64",
               "openSUSE Leap 15.4:libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
               "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
               "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
               "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
               "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
               "openSUSE Leap 15.4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
               "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.aarch64",
               "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
               "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.s390x",
               "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-42916",
               url: "https://www.suse.com/security/cve/CVE-2022-42916",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204386 for CVE-2022-42916",
               url: "https://bugzilla.suse.com/1204386",
            },
            {
               category: "external",
               summary: "SUSE Bug 1206308 for CVE-2022-42916",
               url: "https://bugzilla.suse.com/1206308",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Micro 5.3:curl-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Micro 5.3:libcurl4-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:curl-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:libcurl4-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:curl-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl-devel-32bit-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:libcurl-devel-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl4-32bit-7.79.1-150400.5.9.1.x86_64",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.aarch64",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.ppc64le",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.s390x",
                  "openSUSE Leap 15.4:libcurl4-7.79.1-150400.5.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-10-26T18:20:29Z",
               details: "important",
            },
         ],
         title: "CVE-2022-42916",
      },
   ],
}

cve-2022-42916

Vulnerability from cvelistv5

Published

2022-10-29 00:00

Modified

2024-08-03 13:19

Severity ?

Summary

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.

References

▼	URL	Tags
	https://curl.se/docs/CVE-2022-42916.html
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20221209-0010/
	https://security.gentoo.org/glsa/202212-01	vendor-advisory
	http://www.openwall.com/lists/oss-security/2022/12/21/1	mailing-list
	https://support.apple.com/kb/HT213604
	https://support.apple.com/kb/HT213605
	http://seclists.org/fulldisclosure/2023/Jan/20	mailing-list
	http://seclists.org/fulldisclosure/2023/Jan/19	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:19:05.420Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://curl.se/docs/CVE-2022-42916.html",
               },
               {
                  name: "FEDORA-2022-01ffde372c",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/",
               },
               {
                  name: "FEDORA-2022-39688a779d",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/",
               },
               {
                  name: "FEDORA-2022-e9d65906c4",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20221209-0010/",
               },
               {
                  name: "GLSA-202212-01",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202212-01",
               },
               {
                  name: "[oss-security] 20221221 curl: CVE-2022-43551: Another HSTS bypass via IDN",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2022/12/21/1",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT213604",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT213605",
               },
               {
                  name: "20230123 APPLE-SA-2023-01-23-5 macOS Monterey 12.6.3",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2023/Jan/20",
               },
               {
                  name: "20230123 APPLE-SA-2023-01-23-4 macOS Ventura 13.2",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2023/Jan/19",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-24T00:00:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://curl.se/docs/CVE-2022-42916.html",
            },
            {
               name: "FEDORA-2022-01ffde372c",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/",
            },
            {
               name: "FEDORA-2022-39688a779d",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/",
            },
            {
               name: "FEDORA-2022-e9d65906c4",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20221209-0010/",
            },
            {
               name: "GLSA-202212-01",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202212-01",
            },
            {
               name: "[oss-security] 20221221 curl: CVE-2022-43551: Another HSTS bypass via IDN",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2022/12/21/1",
            },
            {
               url: "https://support.apple.com/kb/HT213604",
            },
            {
               url: "https://support.apple.com/kb/HT213605",
            },
            {
               name: "20230123 APPLE-SA-2023-01-23-5 macOS Monterey 12.6.3",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2023/Jan/20",
            },
            {
               name: "20230123 APPLE-SA-2023-01-23-4 macOS Ventura 13.2",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2023/Jan/19",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-42916",
      datePublished: "2022-10-29T00:00:00",
      dateReserved: "2022-10-13T00:00:00",
      dateUpdated: "2024-08-03T13:19:05.420Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-32221

Vulnerability from cvelistv5

Published

2022-12-05 00:00

Modified

2024-08-03 07:32

Severity ?

Summary

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

References

▼	URL	Tags
	https://hackerone.com/reports/1704017
	https://security.gentoo.org/glsa/202212-01	vendor-advisory
	https://security.netapp.com/advisory/ntap-20230110-0006/
	https://support.apple.com/kb/HT213604
	https://support.apple.com/kb/HT213605
	http://seclists.org/fulldisclosure/2023/Jan/20	mailing-list
	http://seclists.org/fulldisclosure/2023/Jan/19	mailing-list
	https://www.debian.org/security/2023/dsa-5330	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html	mailing-list
	https://security.netapp.com/advisory/ntap-20230208-0002/
	http://www.openwall.com/lists/oss-security/2023/05/17/4	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	https://github.com/curl/curl	Version: Fixed in 7.86.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T07:32:56.010Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/1704017",
               },
               {
                  name: "GLSA-202212-01",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202212-01",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20230110-0006/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT213604",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT213605",
               },
               {
                  name: "20230123 APPLE-SA-2023-01-23-5 macOS Monterey 12.6.3",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2023/Jan/20",
               },
               {
                  name: "20230123 APPLE-SA-2023-01-23-4 macOS Ventura 13.2",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2023/Jan/19",
               },
               {
                  name: "DSA-5330",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2023/dsa-5330",
               },
               {
                  name: "[debian-lts-announce] 20230128 [SECURITY] [DLA 3288-1] curl security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20230208-0002/",
               },
               {
                  name: "[oss-security] 20230517 curl: CVE-2023-28322: more POST-after-PUT confusion",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/05/17/4",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "https://github.com/curl/curl",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Fixed in 7.86.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "Information Disclosure (CWE-200)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-05-17T00:00:00",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://hackerone.com/reports/1704017",
            },
            {
               name: "GLSA-202212-01",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202212-01",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20230110-0006/",
            },
            {
               url: "https://support.apple.com/kb/HT213604",
            },
            {
               url: "https://support.apple.com/kb/HT213605",
            },
            {
               name: "20230123 APPLE-SA-2023-01-23-5 macOS Monterey 12.6.3",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2023/Jan/20",
            },
            {
               name: "20230123 APPLE-SA-2023-01-23-4 macOS Ventura 13.2",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2023/Jan/19",
            },
            {
               name: "DSA-5330",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2023/dsa-5330",
            },
            {
               name: "[debian-lts-announce] 20230128 [SECURITY] [DLA 3288-1] curl security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20230208-0002/",
            },
            {
               name: "[oss-security] 20230517 curl: CVE-2023-28322: more POST-after-PUT confusion",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/05/17/4",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2022-32221",
      datePublished: "2022-12-05T00:00:00",
      dateReserved: "2022-06-01T00:00:00",
      dateUpdated: "2024-08-03T07:32:56.010Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

cve-2022-42916

Vulnerability from cvelistv5

cve-2022-32221

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature