Bug 1198723 - (CVE-2022-27775) VUL-1: CVE-2022-27775: curl: Bad local IPv6 connection reuse
VUL-1: CVE-2022-27775: curl: Bad local IPv6 connection reuse
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
Other Other
: P4 - Low : Normal
: ---
Assigned To: Security Team bot
Security Team bot
Depends on:
  Show dependency treegraph
Reported: 2022-04-21 11:12 UTC by Alexander Bergmann
Modified: 2022-09-20 11:41 UTC (History)
6 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Note You need to log in before you can comment on or make changes to this bug.
Comment 4 Robert Frohl 2022-04-27 06:48:16 UTC

Bad local IPv6 connection reuse

Project curl Security Advisory, April 27 2022 -


libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse, if one of them matches the setup.

Due to errors in the logic, the config matching function did not take the IPv6
address zone id into account which could lead to libcurl reusing the wrong
connection when one transfer uses a zone id and a subsequent transfer uses
another (or no) zone id.

We are not aware of any exploit of this flaw.


Zone ids are only used for non-global scoped IPv6 addresses and they are only
used when specifying the address numerically.

This flaw has existed in curl since commit [2d0e9b40d3237b1](https://github.com/curl/curl/commit/2d0e9b40d3237b1), shipped in libcurl 7.65.0, released on May 22 2019. Previous versions will
instead not accept URLs with zone ids.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2022-27775 to this issue.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Severity: Low


- Affected versions: curl 7.65.0 to and including 7.82.0
- Not affected versions: curl < 7.65.0 and curl >= 7.83.0

Also note that libcurl is used by many applications, and not always advertised
as such.


A [fix for CVE-2022-27775](https://github.com/curl/curl/commit/058f98dc3fe595f21dc26)


 A - Upgrade curl to version 7.83.0

 B - Apply the patch to your local version

 C - Do not use non-global numerical IPv6 addresses in URLs to curl


This issue was reported to the curl project on April 21, 2022. We contacted
distros@openwall on April 21.

libcurl 7.83.0 was released on April 27 2022, coordinated with the publication
of this advisory.


This issue was reported by Harry Sintonen. Patched by Daniel Stenberg.

Thanks a lot!
Comment 10 Swamp Workflow Management 2022-05-13 19:19:54 UTC
SUSE-SU-2022:1657-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1198614,1198723,1198766
CVE References: CVE-2022-22576,CVE-2022-27775,CVE-2022-27776
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    curl-7.66.0-150200.4.30.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    curl-7.66.0-150200.4.30.1
SUSE Linux Enterprise Micro 5.2 (src):    curl-7.66.0-150200.4.30.1
SUSE Linux Enterprise Micro 5.1 (src):    curl-7.66.0-150200.4.30.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Carlos López 2022-09-20 11:41:18 UTC
Done, closing.