CVE-2022-35252 Denial of service in https://github.com/curl/curl
An attacker can cause denial of service against sibling sites by injecting control codes into cookies via curl.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-35252?
CVE-2022-35252 is a low-severity denial of service vulnerability in Apple Macos, published on 23 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
Weakness: CWE-20
Which versions are affected by CVE-2022-35252?
It affects 13 products.
Linux distribution packages (11)
curl SUSE:Linux Enterprise Micro 5.1 | All versions | 7.66.0-150200.4.39.1 |
curl SUSE:Linux Enterprise Micro 5.2 | All versions | 7.66.0-150200.4.39.1 |
curl SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 7.66.0-150200.4.39.1 |
curl SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 7.79.1-150400.5.6.1 |
curl SUSE:Linux Enterprise Server 12 SP5 | All versions | 7.60.0-11.46.1 |
curl SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 7.60.0-11.46.1 |
curl SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 7.60.0-11.46.1 |
curl openSUSE:Leap 15.3 | All versions | 7.66.0-150200.4.39.1 |
curl openSUSE:Leap 15.4 | All versions | 7.79.1-150400.5.6.1 |
curl openSUSE:Leap Micro 5.2 | All versions | 7.66.0-150200.4.39.1 |
curl openSUSE:Tumbleweed | All versions | 7.85.0-1.1 |
Products include Apple Macos, Debian Debian Linux, Haxx Curl, Netapp Bootstrap Os, Netapp Clustered Data Ontap, Netapp Element Software and 7 more.
How do I fix CVE-2022-35252?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-35252 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-35252 exists.
Other vulnerabilities in Apple Macos
Sources
Also known as ALPINE-CVE-2022-35252, AZL-11046, CLEANSTART-2026-OJ03917, CLSA-2022-1663183031, CLSA-2022-1663183585, CLSA-2022-1663184487 and 12 more.