What is CVE-2022-32221?

CVE-2022-32221 is a critical vulnerability affecting libcurl, a widely-used library for HTTP(S) transfers. This issue occurs when libcurl mistakenly uses the read callback during transfers, even when the CURLOPT\_POSTFIELDS option has been set, leading to potential misbehavior in applications and security risks. Systems using libcurl for HTTP(S) transfers, including various software configurations, are affected by this vulnerability. It is essential for users to be aware of this issue and take necessary precautions to ensure the security of their systems.

Who is impacted by this?

The CVE-2022-32221 vulnerability affects users of libcurl, a library commonly used for HTTP(S) transfers. Specifically, those using libcurl versions up to 7.86.0 are impacted. This issue can cause applications to misbehave, potentially sending incorrect data or using memory after it has been freed. It is important for users to be aware of this vulnerability and take necessary precautions to ensure the security of their systems.

What should I do if I’m affected?

If you're affected by the CVE-2022-32221 vulnerability, it's crucial to take action to secure your systems. Follow these simple steps:

1. Upgrade curl to version 8.1.0

2. Apply the patch to your local version

3. Avoid mixing the read callback and CURLOPT\_POSTFIELDS string on a reused easy handle

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-32221 vulnerability, also known as "POST following PUT confusion," is not listed in CISA's Known Exploited Vulnerabilities Catalog. There is no information available regarding the date added, due date, or required action for this specific vulnerability in the catalog. Users should still take necessary precautions to secure their systems, such as upgrading curl to version 8.1.0 and applying the patch to their local version.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-668 and CWE-200, involving exposure of resources and sensitive information.

Learn More

For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• oss-security - curl: CVE-2023-28322: more POST-after-PUT confusion

• curl | Report #1704017 - CVE-2022-32221: POST following PUT confusion | HackerOne