What is the CVSS score of CVE-2022-32205?

CVE-2022-32205 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 26.9%.

Is there a public PoC exploit available for CVE-2022-32205?

Yes, a public proof-of-concept exploit is available for CVE-2022-32205. Prioritise patching immediately. EPSS: 26.9%.

Is there a patch available for CVE-2022-32205?

Yes, a patch is available for CVE-2022-32205. Update the affected software to the latest version immediately.

macOS CVE-2022-32205

Q: Which versions of macOS are affected by CVE-2022-32205?

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them.. A patch is available.

MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2022-07-07 support@hackerone.com

Denial Of Service Apple macOS Debian Siemens Splunk Curl Debian Linux Fedora H300s Firmware H410s Firmware H500s Firmware H700s Firmware Hci Management Node Solidfire Universal Forwarder Element Software Clustered Data Ontap Scalance Sc622 2C Firmware Scalance Sc632 2C Firmware Scalance Sc636 2C Firmware Scalance Sc642 2C Firmware Scalance Sc646 2C Firmware Scalance Sc626 2C Firmware Haxx Netapp Fedoraproject

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

CVE Published

Jul 07, 2022 - 13:15 nvd

MEDIUM 4.3

DescriptionNVD

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on foo.example.com can set cookies that also would match for bar.example.com, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.

AnalysisAI

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl < 7.84.0 stores all of them. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on foo.example.com can set cookies that also would match for bar.example.com, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method. Affected products include: Haxx Curl, Fedoraproject Fedora, Debian Debian Linux, Netapp Clustered Data Ontap, Netapp Element Software.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Set resource limits, implement rate limiting, validate input sizes.