CVE-2022-35260

curl: curl can be told to parse a `.netrc` file for credentials

CVE-2022-35260 is fixed in 10 products on 1 platform, first by DEBIAN-CVE-2022-35260, released December 5, 2022. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
6.5
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0270
86th percentile

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.

Where it's fixed

ProductFixed inFixReleased
Linux
curl · Debian 12.15 (bookworm) 7.86.0-1 DEBIAN-CVE-2022-35260 Dec 5, 2022
curl · Debian 13.5 (trixie) 7.86.0-1 DEBIAN-CVE-2022-35260 Dec 5, 2022
curl · Debian 14 7.86.0-1 DEBIAN-CVE-2022-35260 Dec 5, 2022
curl · amzn 2023 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083 Feb 17, 2023
curl-debuginfo · amzn 2023 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083 Feb 17, 2023
curl-debugsource · amzn 2023 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083 Feb 17, 2023
curl-minimal · amzn 2023 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083 Feb 17, 2023
curl-minimal-debuginfo · amzn 2023 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083 Feb 17, 2023
libcurl · amzn 2023 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083 Feb 17, 2023
libcurl-debuginfo · amzn 2023 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083 Feb 17, 2023
libcurl-devel · amzn 2023 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083 Feb 17, 2023
libcurl-minimal · amzn 2023 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083 Feb 17, 2023
libcurl-minimal-debuginfo · amzn 2023 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083 Feb 17, 2023

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.