curl: Unpreserved file permissions
Published Jul 7, 2022
9.8
CRITICALCVSS 3.1
EPSS 7.74%
Description
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
Affected products
No data.
Configuration 2
- 35
Configuration 3
- 11.0
Configuration 4
- n/a
- n/a
- n/a
- n/a
Configuration 5
Running on/with
- n/a
- n/a
Configuration 6
- n/a
Configuration 7
- n/a
Configuration 8
- n/a
Configuration 9
- n/a
Configuration 11
- ≥ 8.2.0 · < 8.2.12
- ≥ 9.0.0 · < 9.0.6
- 9.1.0
No data.
JBoss Core Services for RHEL 8
jbcs-httpd24-curl-0:7.86.0-2.el8jbcs
Fixed · RHSA-2022:8840
JBoss Core Services on RHEL 7
jbcs-httpd24-curl-0:7.86.0-2.el7jbcs
Fixed · RHSA-2022:8840
Red Hat Enterprise Linux 9
curl-0:7.76.1-14.el9_0.5
Fixed · RHSA-2022:6157
Red Hat Enterprise Linux 9
curl-0:7.76.1-14.el9_0.5
Fixed · RHSA-2022:6157
.NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-curl
Not affected
Red Hat Enterprise Linux 6
curl
Not affected
Red Hat Enterprise Linux 7
curl
Not affected
Red Hat Enterprise Linux 8
curl
Not affected
Red Hat Software Collections
httpd24-curl
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| JBoss Core Services for RHEL 8 | jbcs-httpd24-curl-0:7.86.0-2.el8jbcs | Fixed | RHSA-2022:8840 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-curl-0:7.86.0-2.el7jbcs | Fixed | RHSA-2022:8840 |
| Red Hat Enterprise Linux 9 | curl-0:7.76.1-14.el9_0.5 | Fixed | RHSA-2022:6157 |
| Red Hat Enterprise Linux 9 | curl-0:7.76.1-14.el9_0.5 | Fixed | RHSA-2022:6157 |
| .NET Core 3.1 on Red Hat Enterprise Linux | rh-dotnet31-curl | Not affected | n/a |
| Red Hat Enterprise Linux 6 | curl | Not affected | n/a |
| Red Hat Enterprise Linux 7 | curl | Not affected | n/a |
| Red Hat Enterprise Linux 8 | curl | Not affected | n/a |
| Red Hat Software Collections | httpd24-curl | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:N/C:P/I:P/A:P
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
PoCAutomatable
YesTechnical Impact
TotalDecision
n/aAssessed Apr 23, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (24 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 7.74% (0.07738) | 94.45th | v5 (v2026.06.15) |
| Jul 4, 2026 | 6.82% (0.06823) | 93.24th | v5 (v2026.06.15) |
| Jun 15, 2026 | 5.48% (0.05481) | 91.72th | v5 (v2026.06.15) |
| Nov 21, 2025 | 0.18% (0.00182) | 40.16th | v4 (v2025.03.14) |
| Nov 18, 2025 | 2.39% (0.02390) | 83.69th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.11% (0.00109) | 26.74th | v4 (v2025.03.14) |
| Feb 10, 2025 | 1.34% (0.01339) | 85.99th | v3 (v2023.03.01) |
| Feb 26, 2024 | 0.30% (0.00304) | 68.95th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.28% (0.00279) | 67.42th | v3 (v2023.03.01) |
| Jan 28, 2024 | 0.28% (0.00279) | 65.05th | v3 (v2023.03.01) |
| Dec 18, 2023 | 0.29% (0.00286) | 65.33th | v3 (v2023.03.01) |
| Nov 8, 2023 | 0.24% (0.00243) | 62.08th | v3 (v2023.03.01) |
| Oct 12, 2023 | 0.23% (0.00233) | 61.04th | v3 (v2023.03.01) |
| Aug 9, 2023 | 0.20% (0.00198) | 56.84th | v3 (v2023.03.01) |
| Jul 14, 2023 | 0.17% (0.00165) | 52.26th | v3 (v2023.03.01) |
| Jul 8, 2023 | 0.11% (0.00106) | 42.09th | v3 (v2023.03.01) |
| Jun 7, 2023 | 0.10% (0.00098) | 39.69th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.09% (0.00089) | 36.57th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.18% (0.01183) | 61.76th | v2 (v2022.01.01) |
| Dec 19, 2022 | 1.18% (0.01183) | 61.06th | v2 (v2022.01.01) |
| Oct 31, 2022 | 1.11% (0.01108) | 53.93th | v2 (v2022.01.01) |
| Sep 16, 2022 | 1.02% (0.01018) | 38.94th | v2 (v2022.01.01) |
| Aug 2, 2022 | 0.95% (0.00954) | 34.15th | v2 (v2022.01.01) |
| Jul 8, 2022 | 0.89% (0.00885) | 25.47th | v2 (v2022.01.01) |
References (13)
- http://seclists.org/fulldisclosure/2022/Oct/28 mailing-listMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/41 mailing-listMailing ListThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-32207 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2099305 Issue Tracking
- https://curl.se/docs/CVE-2022-32207.html
- https://hackerone.com/reports/1573634 ExploitThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ vendor-advisoryMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-32207
- https://security.gentoo.org/glsa/202212-01 vendor-advisoryThird Party Advisory
- https://security.netapp.com/advisory/ntap-20220915-0003/ Third Party Advisory
- https://support.apple.com/kb/HT213488 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-32207
- https://www.debian.org/security/2022/dsa-5197 vendor-advisoryThird Party Advisory
Change history (0)
No recorded changes yet.