Critical · published July 7, 2022
🚨 A simple rename could expose sensitive cookie data! Curl versions below 7.84.0 accidentally widen file permissions during cookie saving, making your private browsing info accessible to more users than intended! 🔥 Think of it like a restaurant that mistakenly leaves the back door propped open during a busy night. While it seems secure at first, anyone passing by can easily peek inside and see confidential kitchen orders or recipes—yikes! This vulnerability could lead to an unauthorized user accessing sensitive cookie data and HSTS settings, potentially compromising user sessions and allowing for further attacks. Such exposure is absolutely devastating for user privacy and security!
Think of it like a restaurant that mistakenly leaves the back door propped open during a busy night. While it seems secure at first, anyone passing by can easily peek inside and see confidential kitchen orders or recipes—yikes! The issue lies in how curl handles renaming files when saving cookies and related data. An unintended widening of file permissions occurs during this rename operation, allowing unauthorized access to the updated files.
This vulnerability could lead to an unauthorized user accessing sensitive cookie data and HSTS settings, potentially compromising user sessions and allowing for further attacks. Such exposure is absolutely devastating for user privacy and security! Upgrade curl to version 7.84.0 or later immediately to close this security hole. If you can't update just yet, consider applying stricter file permission settings as a temporary measure. 🛡️ This is fixable! Follow these steps, and you'll be back to secure browsing in no time. You've got this! 💪
| Product | Versions | Fixed in |
|---|---|---|
| haxx/curl | ≥ 7.69.0, < 7.84.0 | 7.84.0 |
| fedoraproject/fedora | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/clustered_data_ontap | all versions | — |
| netapp/element_software | all versions | — |
| netapp/hci_management_node | all versions | — |
| netapp/solidfire | all versions | — |
| netapp/bootstrap_os | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| apple/macos | < 13.0 | 13.0 |
| splunk/universal_forwarder | ≥ 8.2.0, < 8.2.12 | 8.2.12 |
| splunk/universal_forwarder | ≥ 9.0.0, < 9.0.6 | 9.0.6 |
| splunk/universal_forwarder | all versions | — |