CVE-2022-27779

描述

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

如何修補 CVE-2022-27779

要修補 CVE-2022-27779,請將受影響套件升級到下列已修補版本。

• —升級至 7.83.1-r0 或更新版本

CVE-2022-27779 正在被利用嗎?

低 — EPSS 為 2.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 7.82.0, < 7.83.1-r0

CVSS 分數

參考連結(1)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2022-27779