CVE-2022-27781 | libcurl4 (CWE-835)

[mgulter]

A high severity vulnerability has been discovered in your project.

Project Name: IssueTest

Scanner Name: trivy

Cwe ID: 835

Cwe Name: Loop with Unreachable Exit Condition (Infinite Loop)

Cwe Link: https://cwe.mitre.org/data/definitions/835.html

CVE ID: CVE-2022-27781

Target: nginx:latest (debian 11.3)

Packages:

• libcurl4 : 7.74.0-1.3+deb11u1 - Fixed Version:

References:

• https://curl.se/docs/CVE-2022-27781.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27781
• https://github.com/curl/curl/commit/f6c335d63f
• https://hackerone.com/reports/1555441
• https://security.netapp.com/advisory/ntap-20220609-0009/
• https://ubuntu.com/security/notices/USN-5412-1

Tool Description: libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Custom Description: NEW ENDPOINT TEST