medium5.3
CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cook…
Impact
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Haxx | Curl | from 7.82.0 before 7.83.1 |
| Netapp | Hci Bootstrap Os | All versions |
| Netapp | Clustered Data Ontap | All versions |
| Netapp | Solidfire\, Enterprise Sds \& Hci Storage Node | All versions |
| Netapp | Solidfire \& Hci Management Node | All versions |
| Netapp | Hci Compute Node | All versions |
| Netapp | H410s Firmware | All versions |
| Netapp | H700s Firmware | All versions |
| Netapp | H500s Firmware | All versions |
| Netapp | H300s Firmware | All versions |
| Splunk | Universal Forwarder | from 8.2.0 before 8.2.12 from 9.0.0 before 9.0.6 Version 9.1.0 |