CVE-2022-42915

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-42915
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.

8.1 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://seclists.org/fulldisclosure/2023/Jan/19 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jan/19 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jan/20 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jan/20 Mailing List Third Party Advisory
https://curl.se/docs/CVE-2022-42915.html Vendor Advisory
https://curl.se/docs/CVE-2022-42915.html Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/ Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202212-01 Third Party Advisory
https://security.gentoo.org/glsa/202212-01 Third Party Advisory
https://security.netapp.com/advisory/ntap-20221209-0010/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20221209-0010/ Third Party Advisory
https://support.apple.com/kb/HT213604 Third Party Advisory
https://support.apple.com/kb/HT213604 Third Party Advisory
https://support.apple.com/kb/HT213605 Third Party Advisory
https://support.apple.com/kb/HT213605 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

cpe:2.3:a:netapp:ontap_9:-:*:*:*:*:*:*:*

Configuration 8 (hide)

OR cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Configuration 9 (hide)

OR cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
History

07 May 2025, 14:15

Type Values Removed Values Added
References (GENTOO) https://security.gentoo.org/glsa/202212-01 - Third Party Advisory () https://security.gentoo.org/glsa/202212-01 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jan/20 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2023/Jan/20 - Mailing List, Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT213605 - Third Party Advisory () https://support.apple.com/kb/HT213605 - Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT213604 - Third Party Advisory () https://support.apple.com/kb/HT213604 - Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20221209-0010/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20221209-0010/ - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jan/19 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2023/Jan/19 - Mailing List, Third Party Advisory
References (MISC) https://curl.se/docs/CVE-2022-42915.html - Vendor Advisory () https://curl.se/docs/CVE-2022-42915.html - Vendor Advisory

27 Mar 2024, 14:59

Type Values Removed Values Added
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/ - Mailing List, Third Party Advisory
CPE cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
First Time Splunk
Splunk universal Forwarder

07 Nov 2023, 03:53

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/', 'name': 'FEDORA-2022-39688a779d', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/', 'name': 'FEDORA-2022-e9d65906c4', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/', 'name': 'FEDORA-2022-01ffde372c', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/ -

15 Jun 2023, 19:44

Type Values Removed Values Added
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jan/20 - Third Party Advisory (FULLDISC) http://seclists.org/fulldisclosure/2023/Jan/20 - Mailing List, Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jan/19 - Third Party Advisory (FULLDISC) http://seclists.org/fulldisclosure/2023/Jan/19 - Mailing List, Third Party Advisory
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 8.1
Information

Published : 2022-10-29 20:15

Updated : 2025-05-07 14:15

NVD link : CVE-2022-42915

Mitre link : CVE-2022-42915

JSON object : View

Products Affected

netapp

  • h410s
  • h500s
  • h300s
  • h700s_firmware
  • h500s_firmware
  • h410s_firmware
  • h700s
  • ontap_9
  • h300s_firmware

fedoraproject

  • fedora

splunk

  • universal_forwarder

haxx

  • curl

apple

  • macos
CWE
CWE-415

Double Free