CVE-2022-22576

Name of the Vulnerable Software and Affected Versions curl versions 7.33.0 through 7.82.0

Description An improper authentication issue exists, potentially allowing the reuse of OAUTH2-authenticated connections without ensuring the connection was authenticated with the same credentials as set for the transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S), and LDAP(S) (openldap only). The issue is related to how libcurl maintains a pool of live connections after a transfer has completed, which can lead to an authentication bypass if a connection is reused with different credentials.

Recommendations For curl versions 7.33.0 through 7.82.0, consider disabling the reuse of OAUTH2-authenticated connections as a temporary workaround until a patch is available. Restrict access to SASL-enabled protocols to minimize the risk of exploitation. Avoid reusing connections authenticated with OAUTH2 bearers for different users or credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.