Buy commercial curl support from WolfSSL. We help you work
out your issues, debug your libcurl applications, use the API, port to new
platforms, add new features and more. With a team lead by the curl founder
himself.
[SECURITY ADVISORY] curl: removes wrong file on error
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-users <curl-users_at_lists.haxx.se>
Date: Wed, 11 May 2022 08:36:59 +0200 (CEST)
curl removes wrong file on error
================================
Project curl Security Advisory, May 11 2022 -
[Permalink](https://curl.se/docs/CVE-2022-27778.html)
VULNERABILITY
-------------
curl might remove the wrong file when `--no-clobber` is used together with
`--remove-on-error`.
The `--remove-on-error` option tells curl to remove the output file when it
returns an error, and not leave a partial file behind. The `--no-clobber`
option prevents curl from overwriting a file if it already exists, and instead
appends a number to the name to create a new unused file name.
If curl adds a number to not "clobber" the output and an error occurs during
transfer, the remove on error logic would remove the *original* file name
without the added number.
We are not aware of any exploit of this flaw.
INFO
Date: Wed, 11 May 2022 08:36:59 +0200 (CEST)
curl removes wrong file on error
================================
Project curl Security Advisory, May 11 2022 -
[Permalink](https://curl.se/docs/CVE-2022-27778.html)
VULNERABILITY
-------------
curl might remove the wrong file when `--no-clobber` is used together with
`--remove-on-error`.
The `--remove-on-error` option tells curl to remove the output file when it
returns an error, and not leave a partial file behind. The `--no-clobber`
option prevents curl from overwriting a file if it already exists, and instead
appends a number to the name to create a new unused file name.
If curl adds a number to not "clobber" the output and an error occurs during
transfer, the remove on error logic would remove the *original* file name
without the added number.
We are not aware of any exploit of this flaw.
INFO
---- This flaw is only present in the command line tool, not the library. This flaw was introduced in curl 7.83.0 with the addition of these two options that together created this problem. Since both these command line options are brand new in this version, chances are not too many users have actually had time to experience this problem. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2022-27778 to this issue. CWE-706: Use of Incorrectly-Resolved Name or Reference Severity: Medium AFFECTED VERSIONS ----------------- - Affected versions: curl 7.83.0 - Not affected versions: curl < 7.83.0 and curl >= 7.83.1 THE SOLUTION ------------ A [fix for CVE-2022-27778](https://github.com/curl/curl/commit/8c7ee9083d0d71) RECOMMENDATIONS -------------- A - Upgrade curl to version 7.83.1 B - Apply the patch to your local version C - Do not use `--no-clobber` with `--remove-on-error` TIMELINE -------- This issue was reported to the curl project on April 28, 2022. We contacted distros_at_openwall on May 5. libcurl 7.83.1 was released on May 11 2022, coordinated with the publication of this advisory. CREDITS ------- This issue was reported by Harry Sintonen. Patched by Daniel Stenberg. Thanks a lot! -- / daniel.haxx.se | Commercial curl support up to 24x7 is available! | Private help, bug fixes, support, ports, new features | https://curl.se/support.html -- Unsubscribe: https://lists.haxx.se/listinfo/curl-users Etiquette: https://curl.haxx.se/mail/etiquette.htmlReceived on 2022-05-11