CVE-2022-27782
📋 TL;DR
libcurl incorrectly reuses TLS/SSH connections when security settings have changed, potentially allowing sensitive data to be transmitted over less secure connections. This affects any application using vulnerable libcurl versions for HTTPS or SSH transfers.
💻 Affected Systems
- libcurl
- curl
- applications using libcurl
📦 What is this software?
Curl by Haxx
curl is a command-line tool and library for transferring data with URLs. It supports numerous protocols including HTTP, HTTPS, FTP, and more, making it essential for API testing, web scraping, and automated data transfers.
Learn more about Curl →⚠️ Risk & Real-World Impact
Worst Case
Sensitive data transmitted over downgraded or misconfigured TLS/SSH connections, leading to interception or man-in-the-middle attacks.
Likely Case
Accidental data leakage when applications change security settings between requests but connections are incorrectly reused.
If Mitigated
Minimal impact with proper network segmentation and monitoring of connection security parameters.
🎯 Exploit Status
Exploitation requires control over TLS/SSH configuration changes between requests and ability to intercept connections.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libcurl 7.83.1
Vendor Advisory: https://curl.se/docs/CVE-2022-27782.html
Restart Required: Yes
Instructions:
1. Update libcurl to version 7.83.1 or later. 2. Recompile applications using libcurl. 3. Restart affected services.
🔧 Temporary Workarounds
Disable connection reuse
allPrevent libcurl from reusing connections entirely
curl_easy_setopt(curl, CURLOPT_FORBID_REUSE, 1L)
Force new connections
allClose connections after each request
curl_easy_setopt(curl, CURLOPT_FRESH_CONNECT, 1L)
🧯 If You Can't Patch
- Monitor for unexpected TLS/SSH connection downgrades
- Implement network segmentation to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check libcurl version: curl --version | head -1Check Version:
curl --version | head -1Verify Fix Applied:
Verify version is 7.83.1 or higher: curl --version | grep -E '^curl 7\.(8[3-9]|[9-9][0-9])'📡 Detection & Monitoring
Log Indicators:
- Unexpected TLS version changes between requests
- SSH connection parameter mismatches
Network Indicators:
- TLS/SSL handshake anomalies for reused connections
- Inconsistent cipher suite usage
SIEM Query:
source="*curl*" AND ("TLS" OR "SSL") AND "reuse" AND "mismatch"🔗 References
- http://www.openwall.com/lists/oss-security/2023/03/20/6
- https://hackerone.com/reports/1555796
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20220609-0009/
- https://www.debian.org/security/2022/dsa-5197
- http://www.openwall.com/lists/oss-security/2023/03/20/6
- https://hackerone.com/reports/1555796
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20220609-0009/
- https://www.debian.org/security/2022/dsa-5197
