What’s Vulnerable › Vulnerabilities

CVE-2022-32207

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 12.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-07 · updated 2026-10-14
• Weakness: CWE-840

Description

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

Affected products

• Apple macOS: before 13.0 — fixed in 13.0
• Debian Linux: 11.0
• Fedoraproject Fedora: 35
• curl: from 7.69.0 before 7.84.0 — fixed in 7.84.0
• NetApp Bootstrap Os: all versions
• Clustered Data ONTAP: all versions
• NetApp Element Software: all versions
• NetApp H300S Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Hci Management Node: all versions
• NetApp Solidfire: all versions
• Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6

How to fix

Upgrade to a fixed version: Apple macOS 13.0; curl 7.84.0; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2022/Oct/28
• http://seclists.org/fulldisclosure/2022/Oct/41
• https://hackerone.com/reports/1573634
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20220915-0003/
• https://support.apple.com/kb/HT213488
• https://www.debian.org/security/2022/dsa-5197
• http://seclists.org/fulldisclosure/2022/Oct/28
• http://seclists.org/fulldisclosure/2022/Oct/41
• https://hackerone.com/reports/1573634
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/

Get alerted when CVE-2022-32207 or the next vulnerability affects your stack