CVE-2022-27774
Publication date 27 April 2022
Last updated 25 August 2025
Ubuntu priority
Description
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| curl | 22.04 LTS jammy |
Fixed 7.81.0-1ubuntu1.1
|
| 20.04 LTS focal |
Fixed 7.68.0-1ubuntu2.10
|
|
| 18.04 LTS bionic |
Fixed 7.58.0-2ubuntu3.17
|
|
| 16.04 LTS xenial | Ignored end of ESM support, was ignored [regressions likely] | |
| 14.04 LTS trusty | Ignored end of ESM support, was ignored [regressions likely] |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.7 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
References
Related Ubuntu Security Notices (USN)
- USN-5397-1
- curl vulnerabilities
- 28 April 2022