CVE-2022-32208

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-07 · updated 2026-10-14
Weakness: CWE-840

Description

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Affected products

Apple macOS: before 13.0 — fixed in 13.0
Debian Linux: 10.0, 11.0
Fedoraproject Fedora: 35
curl: from 7.16.4 before 7.84.0 — fixed in 7.84.0
NetApp Bootstrap Os: all versions
Clustered Data ONTAP: all versions
NetApp Element Software: all versions
NetApp H300S Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700S Firmware: all versions
NetApp Hci Management Node: all versions
NetApp Solidfire: all versions
Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6

How to fix

Upgrade to a fixed version: Apple macOS 13.0; curl 7.84.0; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-32208 or the next vulnerability affects your stack