CVE-2022-32207

Name of the Vulnerable Software and Affected Versions curl versions prior to 7.84.0

Description The issue is related to how curl saves cookies, alt-svc, and hsts data to local files. When curl performs this operation, it uses a temporary file that is later renamed to the final target filename. However, during this rename operation, the permissions for the target file might be accidentally widened, making the updated file accessible to more users than intended. This could potentially allow a remote attacker to disclose protected information or cause a denial of service.

Recommendations For versions prior to 7.84.0, update to curl version 7.84.0 to resolve the issue. As a temporary workaround, consider restricting access to the files where cookies, alt-svc, and hsts data are saved to minimize the risk of exploitation.