CVE and update status of the FreeBSD ports tree4,211 unaddressed CVEs in 613 portsAll times are CET

CVE details

CVE-2022-27774

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Score
5.7 medium
Published
2022-06-02
Links
NVD · cve.org

Affected ports (2)

PortPackageVersionStatusMaintainer
ftp/linux-c7-curllinux-c7-curl7.29.0_13unaddressedemulation@FreeBSD.org
ftp/linux-rl9-curllinux-rl9-curl7.76.1_13unaddressedemulation@FreeBSD.org

VuXML

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-c7-curl</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>linux-rl9-curl</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An insufficiently protected credentials vulnerability exists in curl
	4.9 to and include curl 7.82.0 are affected that could allow an
	attacker to extract credentials when follows HTTP(S) redirects is used
	with authentication could leak credentials to other services that
	exist on different protocols or port numbers.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2022-27774</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2022-27774</url>
    </references>
    <dates>
      <discovery>2022-06-02</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>