Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 16 products
🚨 HIGH SEVERITY: CVE-2022-27781 (CVSS 7.5) libcurl with NSS vulnerable to DoS via infinite loop when processing certificate info from malicious servers. Affects CURLOPT_CERTINFO option. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/5qGflYSv1H
Post summary
High‑severity CVE-2022‑27781 in libcurl with NSS causes a DoS via an infinite loop when handling certificate info and requires an immediate patch.
18 of 18 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 10.0 | - | - |
| OS | debian | debian_linux | 11.0 | - | - |
| App | haxx | curl | - | - | - |
| App | netapp | clustered_data_ontap | - | - | - |
| HW | netapp | h300s | - | - | - |
| OS | netapp | h300s_firmware | - | - | - |
| HW | netapp | h410s | - | - | - |
| OS | netapp | h410s_firmware | - | - | - |
| HW | netapp | h500s | - | - | - |
| OS | netapp | h500s_firmware | - | - | - |
| HW | netapp | h700s | - | - | - |
| OS | netapp | h700s_firmware | - | - | - |
| OS | netapp | hci_bootstrap_os | - | - | - |
| HW | netapp | hci_compute_node | - | - | - |
| App | netapp | solidfire\,_enterprise_sds_\&_hci_storage_node | - | - | - |
| App | netapp | solidfire_\&_hci_management_node | - | - | - |
| App | splunk | universal_forwarder | - | - | - |
| App | splunk | universal_forwarder | 9.1.0 | - | - |