CVE-2022-32208 json
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
published 2022-07-07 4 y ago modified 2026-10-14 25 d ago also EUVD-2022-53414 , JLSEC-2026-395
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.4%
- EPSS 8.4% chance of exploitation in 30 days, percentile 95%
- public exploits
- 0
- none known
Summary
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
Patch / fix
- julia CURL_jll 8.5.0+0
- julia LibCURL_jll 7.84.0+0
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- curl Debian 14, Debian 13, Debian 12 7.84.0-1
debian advisories DEBIAN-CVE-2022-32208
- curl Ubuntu 18.04 LTS 7.58.0-2ubuntu3.19
- curl Ubuntu 20.04 LTS 7.68.0-1ubuntu2.12
- curl Ubuntu 22.04 LTS 7.81.0-1ubuntu1.3
- curl Ubuntu Pro 14.04 LTS 7.35.0-1ubuntu2.20+esm11
- curl Ubuntu Pro 16.04 LTS 7.47.0-1ubuntu2.19+esm4
ubuntu advisories UBUNTU-CVE-2022-32208
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- jbcs-httpd24-curl jboss core services 1 7.86.0-2.el7jbcs
- jbcs-httpd24-curl jboss core services 1 7.86.0-2.el8jbcs
- jbcs-httpd24-httpd jboss core services 1 2.4.51-37.el7jbcs
- jbcs-httpd24-httpd jboss core services 1 2.4.51-37.el8jbcs
- jbcs-httpd24-libcurl jboss core services 1 7.86.0-2.el7jbcs
- jbcs-httpd24-libcurl jboss core services 1 7.86.0-2.el8jbcs
- jbcs-httpd24-mod_ssl jboss core services 1 1:2.4.51-37.el7jbcs
- jbcs-httpd24-mod_ssl jboss core services 1 1:2.4.51-37.el8jbcs
red hat advisories RHSA-2022:8840RHSA-2022:6157RHSA-2022:6159
- curl SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +7 more 7.60.0-150000.33.1
- curl SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 7.60.0-4.38.1
- curl SLES 12 SP3-BCL, SLES 12 SP2-BCL 7.37.0-37.79.1
- curl SLES 15 SP2-BCL, SLE Module for Basesystem 15 SP3, SLE Micro 5.2 +11 more 7.66.0-150200.4.36.1
- curl SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 7.79.1-150400.5.3.1
- curl SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 7.60.0-11.43.1
suse advisories SUSE-SU-2022:2829-1SUSE-SU-2022:2813-1SUSE-SU-2022:2356-1SUSE-SU-2022:2327-2SUSE-SU-2022:2327-1SUSE-SU-2022:2305-1
- curl openSUSE Tumbleweed 7.84.0-1.1
opensuse advisories openSUSE-SU-2024:12214-1
- curl AlmaLinux 9 7.76.1-14.el9_0.5
- libcurl AlmaLinux 9 7.76.1-14.el9_0.5
- curl-minimal AlmaLinux 9 7.76.1-14.el9_0.5
- libcurl-minimal AlmaLinux 9 7.76.1-14.el9_0.5
- curl AlmaLinux 8 7.61.1-22.el8_6.4
- libcurl AlmaLinux 8 7.61.1-22.el8_6.4
- libcurl-minimal AlmaLinux 8 7.61.1-22.el8_6.4
almalinux advisories ALSA-2022:6157ALSA-2022:6159
- curl Rocky Linux 8 7.61.1-22.el8_6.4
- curl Rocky Linux 9 7.76.1-14.el9_0.5
rocky linux advisories RLSA-2022:6159RLSA-2022:6157
- curl Alpine 3.14, Alpine 3.13 7.79.1-r2
- curl Alpine 3.15 7.80.0-r2
- curl Alpine 3.16 7.83.1-r2
- curl Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 7.84.0-r0
alpine advisories ALPINE-CVE-2022-32208
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- curl CBL-Mariner 2.0 7.84.0-1
azure linux advisories AZL-10104
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- libcurl-compat Arch Linux 7.84.0-1
- curl Arch Linux 7.84.0-1
- libcurl-gnutls Arch Linux 7.84.0-1
arch linux advisories AVG-2817
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-32208 updated cvss 5.3
curl: FTP-KRB bad message verification
-
Red Hat .NET Core 3.1 on Red Hat Enterprise Linux rh-dotnet31-curl, rh-dotnet31-libcurl Red Hat Enterprise Linux 6 curl, libcurl Red Hat Enterprise Linux 7 curl, libcurlaffected: no fix planned “Out of support scope”
-
Red Hat Software Collections httpd24-curl, httpd24-libcurlaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel 7.76.1-14.el9_0.5, curl-debuginfo 7.76.1-14.el9_0.5, curl-debugsource 7.76.1-14.el9_0.5, libcurl-debuginfo 7.76.1-14.el9_0.5, curl-minimal-debuginfo 7.76.1-14.el9_0.5, libcurl-minimal-debuginfo 7.76.1-14.el9_0.5fixed: vendor fix RHSA-2022:6157
-
Red Hat Enterprise Linux BaseOS (v. 8) curl 7.61.1-22.el8_6.4, libcurl 7.61.1-22.el8_6.4, libcurl-minimal 7.61.1-22.el8_6.4fixed: vendor fix RHSA-2022:6159
-
Red Hat Enterprise Linux BaseOS (v. 9) curl 7.76.1-14.el9_0.5, libcurl 7.76.1-14.el9_0.5, curl-minimal 7.76.1-14.el9_0.5, libcurl-minimal 7.76.1-14.el9_0.5fixed: vendor fix RHSA-2022:6157
-
Red Hat JBoss Core Servicesfixed: vendor fix RHSA-2022:8841
-
Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl 7.86.0-2.el7jbcs, jbcs-httpd24-libcurl 7.86.0-2.el7jbcs Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl 7.86.0-2.el8jbcs, jbcs-httpd24-libcurl 7.86.0-2.el8jbcsfixed: vendor fix RHSA-2022:8840
-
Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd 2.4.51-37.el7jbcs, jbcs-httpd24-mod_md 2.4.0-18.el7jbcs, jbcs-httpd24-apr-util 1.6.1-99.el7jbcs, jbcs-httpd24-mod_ssl 2.4.51-37.el7jbcs, jbcs-httpd24-nghttp2 1.43.0-11.el7jbcs, jbcs-httpd24-openssl 1.1.1k-13.el7jbcs, +22 more Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-httpd 2.4.51-37.el8jbcs, jbcs-httpd24-mod_md 2.4.0-18.el8jbcs, jbcs-httpd24-apr-util 1.6.1-99.el8jbcs, jbcs-httpd24-mod_ssl 2.4.51-37.el8jbcs, jbcs-httpd24-nghttp2 1.43.0-11.el8jbcs, jbcs-httpd24-openssl 1.1.1k-13.el8jbcs, +22 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-23-348-10 updated cvss 5.9
Siemens SIMATIC S7-1500
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5affected: fixed in V3.1.5, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-23-103-09 updated cvss 5.9
Siemens SCALANCE XCM332
-
Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.2affected: fixed in V2.2 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-23-166-12 updated cvss 5.9
Siemens SINAMICS Medium Voltage Products
-
Siemens SINAMICS PERFECT HARMONY GH180 6SR5affected: vendor fix, mitigation
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-23-075-01 updated cvss 5.9
Siemens SCALANCE, RUGGEDCOM Third-Party
-
Siemens RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) <V7.2 Siemens RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) <V7.2 Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2) <V7.2 Siemens SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) <V7.2 Siemens SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) <V7.2 Siemens SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) <V7.2affected: fixed in V7.2 support.industry.siemens.com
+14 more productsfewer
Siemens SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) <V7.2 Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) <V7.2 Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2) <V7.2 Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2) <V7.2 Siemens SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) <V7.2 Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) <V7.2 Siemens SCALANCE M876-4 (6GK5876-4AA10-2BA2) <V7.2 Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) <V7.2 Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) <V7.2 Siemens SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) <V7.2 Siemens SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) <V7.2 Siemens SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) <V7.2 Siemens SCALANCE S615 (6GK5615-0AA00-2AA2) <V7.2 Siemens SCALANCE S615 EEC (6GK5615-0AA01-2AA2) <V7.2
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
8.37% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- hackerone.com https://hackerone.com/reports/1590071 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| OSV | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | CURL_jll | <8.5.0+0 |
8.5.0+0 |
| julia | LibCURL_jll | <7.84.0+0 |
7.84.0+0 |
Affected products
- n/a https://github.com/curl/curl
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SINAMICS PERFECT HARMONY GH180
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
References
-
hackerone.com
/reports/1590071
exploit, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
vendor-advisory, mailing-list, third-party-advisory, web
-
debian.org
/security/2022/dsa-5197
vendor-advisory, third-party-advisory, web
-
security.gentoo.org
/glsa/202212-01
vendor-advisory, third-party-advisory, web
-
lists.debian.org
/debian-lts-announce/2022/08/msg00017.html
mailing-list, third-party-advisory, web
-
security.netapp.com
/advisory/ntap-20220915-0003/
third-party-advisory, web
-
support.apple.com
/kb/HT213488
third-party-advisory, web
-
seclists.org
/fulldisclosure/2022/Oct/41
mailing-list, third-party-advisory, web
-
seclists.org
/fulldisclosure/2022/Oct/28
mailing-list, third-party-advisory, web
- cert-portal.siemens.com /productcert/html/ssa-419740.html
- cert-portal.siemens.com /productcert/html/ssa-558014.html
- cert-portal.siemens.com /productcert/html/ssa-942865.html
- cert-portal.siemens.com /productcert/html/ssa-398330.html
Sources
- CVE List CVE-2022-32208
- NVD CVE-2022-32208
- OSV JLSEC-2026-395
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.