CVE-2022-32205

NameCVE-2022-32205
DescriptionA malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5197-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
curl (PTS)buster7.64.0-4+deb10u2fixed
buster (security)7.64.0-4+deb10u3fixed
bullseye7.74.0-1.3+deb11u3fixed
bullseye (security)7.74.0-1.3+deb11u2fixed
bookworm, sid7.86.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
curlsourcestretch(not affected)
curlsourcebuster(not affected)
curlsourcebullseye7.74.0-1.3+deb11u2DSA-5197-1
curlsource(unstable)7.84.0-1

Notes

[buster] - curl <not-affected> (Vulnerable code introduced later)
[stretch] - curl <not-affected> (Vulnerable code introduced later)
https://curl.se/docs/CVE-2022-32205.html
Introduced by: https://github.com/curl/curl/commit/ed35d6590e72c23c568af1e3b8ac6e4e2d883888 (curl-7_71_0)
Fixed by: https://github.com/curl/curl/commit/48d7064a49148f03942380967da739dcde1cdc24 (curl-7_84_0)

Search for package or bug name: Reporting problems