CVE-2022-22576 | curl (CWE-287)

[mgulter]

A high severity vulnerability has been discovered in your project.

Project Name: IssueTest

Scanner Name: trivy

Cwe ID: 287

Cwe Name: Improper Authentication

Cwe Link: https://cwe.mitre.org/data/definitions/287.html

CVE ID: CVE-2022-22576

Target: nginx:latest (debian 11.3)

Packages:

• curl : 7.74.0-1.3+deb11u1 - Fixed Version:

References:

• https://curl.se/docs/CVE-2022-22576.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22576
• https://hackerone.com/reports/1526328
• https://security.netapp.com/advisory/ntap-20220609-0008/
• https://ubuntu.com/security/notices/USN-5397-1

Training(Secure Code Warrior):

• Name: Improper Authentication

• Description: When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

• Link: https://portal.securecodewarrior.com/?utm_source=partner-integration:kondukto#/contextual-microlearning/web/auth/missingauth

• Videos:

  • https://media.securecodewarrior.com/v2/module_128_improper_authentication.mp4

Tool Description: An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

Custom Description: test