CVE-2022-27778
curl removes wrong file on error
Project curl Security Advisory, May 11 2022 - Permalink
VULNERABILITY
curl might remove the wrong file when --no-clobber is
used together with --remove-on-error.
The --remove-on-error option tells curl to remove the
output file when it returns an error, and not leave a partial file
behind. The --no-clobber option prevents curl from
overwriting a file if it already exists, and instead appends a number to
the name to create a new unused filename.
If curl adds a number to not "clobber" the output and an error occurs during transfer, the remove on error logic would remove the original filename without the added number.
INFO
This flaw is only present in the command line tool, not the library.
This flaw was introduced in curl 7.83.0 with the addition of these two options that together created this problem. Since both these command line options are brand new in this version, chances are not too many users have actually had time to experience this problem.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2022-27778 to this issue.
CWE-706: Use of Incorrectly-Resolved Name or Reference
Severity: Medium
AFFECTED VERSIONS
- Affected versions: curl 7.83.0 to and including 7.83.0
- Not affected versions: curl < 7.83.0 and curl >= 7.83.1
- Introduced-in: https://github.com/curl/curl/commit/08a96c6e4e6cf6a1917a1
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 7.83.1
B - Apply the patch to your local version
C - Do not use --no-clobber with
--remove-on-error
TIMELINE
This issue was reported to the curl project on April 28, 2022. We contacted distros@openwall on May 5.
libcurl 7.83.1 was released on May 11 2022, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Harry Sintonen
- Patched-by: Daniel Stenberg
Thanks a lot!