CVEvulnerability

CVE-2022-30115

4.3 MEDIUM Published 2022-06-02 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2022-06-02
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-319, CWE-325

Description

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.

Affected configurations

• haxx curl (>= 7.82.0 < 7.83.1) • netapp hci bootstrap os • netapp clustered data ontap • netapp solidfire\, enterprise sds \& hci storage node • netapp solidfire \& hci management node • netapp h300s firmware • netapp h500s firmware • netapp h700s firmware • netapp h410s firmware • splunk universal forwarder (>= 8.2.0 < 8.2.12) • splunk universal forwarder (>= 9.0.0 < 9.0.6) • splunk universal forwarder 9.1.0

Related

Weakness · CWE (2)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness
  • CWE-325 Missing Cryptographic Step weakness

References