CVE-2022-27776

Name	CVE-2022-27776
Description	A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-5197-1
Debian Bugs	1010252

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	buster, buster (security)	7.64.0-4+deb10u2	vulnerable
	bullseye	7.74.0-1.3+deb11u1	vulnerable
	bullseye (security)	7.74.0-1.3+deb11u2	fixed
	bookworm, sid	7.84.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
curl	source	bullseye	7.74.0-1.3+deb11u2		DSA-5197-1
curl	source	(unstable)	7.83.0-1			1010252

https://curl.se/docs/CVE-2022-27776.html
Fixed by: https://github.com/curl/curl/commit/6e659993952aa5f90f48864be84a1bbb047fc258 (curl-7_83_0)