Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 843824 (CVE-2022-27779, CVE-2022-27780, CVE-2022-27781, CVE-2022-27782, CVE-2022-30115)

Summary: <net-misc/curl-7.81.1: multiple vulnerabilities
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: blueness
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A3 [glsa+]
Package list:
Runtime testing required: ---
Bug Depends on: 842531    
Bug Blocks:    

Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-05-11 22:05:21 UTC
curl: removes wrong file on error

curl: cookie for trailing dot TLD

curl: percent-encoded path separator in URL host

curl: CERTINFO never-ending busy-loop

curl: TLS and SSH connection too eager reuse

curl: HSTS bypass via trailing dot

Please bump to 7.83.1.
Comment 1 Anthony Basile gentoo-dev 2022-05-13 19:18:07 UTC
(In reply to John Helmert III from comment #0)
> Please bump to 7.83.1.

I just added it to the tree and preliminary tests look good.  Please stabilize.
Comment 2 Larry the Git Cow gentoo-dev 2022-12-19 02:05:21 UTC
The bug has been referenced in the following commit(s):

commit d4066956acc3f238eef20bbbad18f982301dd80b
Author:     GLSAMaker <>
AuthorDate: 2022-12-19 01:59:44 +0000
Commit:     John Helmert III <>
CommitDate: 2022-12-19 02:04:27 +0000

    [ GLSA 202212-01 ] curl: Multiple Vulnerabilities
    Signed-off-by: GLSAMaker <>
    Signed-off-by: John Helmert III <>

 glsa-202212-01.xml | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-12-19 02:29:10 UTC
GLSA released, all done.