Bug 2082204 (CVE-2022-27781) - CVE-2022-27781 curl: CERTINFO never-ending busy-loop
Summary: CVE-2022-27781 curl: CERTINFO never-ending busy-loop
Keywords:
Status: NEW
Alias: CVE-2022-27781
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2083986 2083731 2083732 2083733 2083985
Blocks: 2082195
TreeView+ depends on / blocked
 
Reported: 2022-05-05 15:10 UTC by Marian Rehak
Modified: 2022-05-11 14:44 UTC (History)
25 users (show)

Fixed In Version: curl 7.83.1
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in curl. This issue occurs due to an erroneous function. A malicious server could make curl within Network Security Services (NSS) get stuck in a never-ending busy loop when trying to retrieve that information. This flaw allows an Infinite Loop, affecting system availability.
Clone Of:
Environment:
Last Closed:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Marian Rehak 2022-05-05 15:10:13 UTC 
libcurl provides the `CURLOPT_CERTINFO` option to allow applications to request details to be returned about a TLS server's certificate chain. Due to an erroneous function, a malicious server could make libcurl built with NSS get stuck in a never-ending busy-loop when trying to retrieve that information
Comment 3 Sandipan Roy 2022-05-11 07:26:42 UTC 
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 2083985]


Created mingw-curl tracking bugs for this issue:

Affects: fedora-all [bug 2083986]
Note You need to log in before you can comment on or make changes to this bug.