{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"Medium"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"curl security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for curl is now available for openEuler-20.03-LTS-SP1.",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"CURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\n\nSecurity Fix(es):\n\nA vulnerability was found in curl. The issue occurs when doing HTTP(S) transfers, where curl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set if it previously used the same handle to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request.(CVE-2022-32221)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for curl is now available for openEuler-20.03-LTS-SP1.\n\nopenEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"Medium",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"curl",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2022-2039",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2039"
			},
			{
				"summary":"CVE-2022-32221",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2022-32221&packageName=curl"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32221"
			},
			{
				"summary":"openEuler-SA-2022-2039 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2022/csaf-openeuler-sa-2022-2039.json"
			}
		],
		"title":"An update for curl is now available for openEuler-20.03-LTS-SP1",
		"tracking":{
			"initial_release_date":"2022-11-04T09:48:50+08:00",
			"revision_history":[
				{
					"date":"2022-11-04T09:48:50+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				},
				{
					"date":"2024-10-31T09:48:50+08:00",
					"summary":"final",
					"number":"2.0.0"
				}
			],
			"generator":{
				"date":"2024-10-31T09:48:50+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2024-10-31T09:48:50+08:00",
			"id":"openEuler-SA-2022-2039",
			"version":"2.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"openEuler-20.03-LTS-SP1",
									"name":"openEuler-20.03-LTS-SP1"
								},
								"name":"openEuler-20.03-LTS-SP1",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"aarch64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"libcurl-devel-7.71.1-19.oe1.aarch64.rpm(20.03-LTS-SP1)",
									"name":"libcurl-devel-7.71.1-19.oe1.aarch64.rpm"
								},
								"name":"libcurl-devel-7.71.1-19.oe1.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"curl-debuginfo-7.71.1-19.oe1.aarch64.rpm(20.03-LTS-SP1)",
									"name":"curl-debuginfo-7.71.1-19.oe1.aarch64.rpm"
								},
								"name":"curl-debuginfo-7.71.1-19.oe1.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"libcurl-7.71.1-19.oe1.aarch64.rpm(20.03-LTS-SP1)",
									"name":"libcurl-7.71.1-19.oe1.aarch64.rpm"
								},
								"name":"libcurl-7.71.1-19.oe1.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"curl-debugsource-7.71.1-19.oe1.aarch64.rpm(20.03-LTS-SP1)",
									"name":"curl-debugsource-7.71.1-19.oe1.aarch64.rpm"
								},
								"name":"curl-debugsource-7.71.1-19.oe1.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"curl-7.71.1-19.oe1.aarch64.rpm(20.03-LTS-SP1)",
									"name":"curl-7.71.1-19.oe1.aarch64.rpm"
								},
								"name":"curl-7.71.1-19.oe1.aarch64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"curl-help-7.71.1-19.oe1.noarch.rpm(20.03-LTS-SP1)",
									"name":"curl-help-7.71.1-19.oe1.noarch.rpm"
								},
								"name":"curl-help-7.71.1-19.oe1.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"curl-7.71.1-19.oe1.src.rpm(20.03-LTS-SP1)",
									"name":"curl-7.71.1-19.oe1.src.rpm"
								},
								"name":"curl-7.71.1-19.oe1.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"x86_64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"curl-debuginfo-7.71.1-19.oe1.x86_64.rpm(20.03-LTS-SP1)",
									"name":"curl-debuginfo-7.71.1-19.oe1.x86_64.rpm"
								},
								"name":"curl-debuginfo-7.71.1-19.oe1.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"libcurl-devel-7.71.1-19.oe1.x86_64.rpm(20.03-LTS-SP1)",
									"name":"libcurl-devel-7.71.1-19.oe1.x86_64.rpm"
								},
								"name":"libcurl-devel-7.71.1-19.oe1.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"curl-7.71.1-19.oe1.x86_64.rpm(20.03-LTS-SP1)",
									"name":"curl-7.71.1-19.oe1.x86_64.rpm"
								},
								"name":"curl-7.71.1-19.oe1.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"curl-debugsource-7.71.1-19.oe1.x86_64.rpm(20.03-LTS-SP1)",
									"name":"curl-debugsource-7.71.1-19.oe1.x86_64.rpm"
								},
								"name":"curl-debugsource-7.71.1-19.oe1.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"libcurl-7.71.1-19.oe1.x86_64.rpm(20.03-LTS-SP1)",
									"name":"libcurl-7.71.1-19.oe1.x86_64.rpm"
								},
								"name":"libcurl-7.71.1-19.oe1.x86_64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"libcurl-devel-7.71.1-19.oe1.aarch64.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:libcurl-devel-7.71.1-19.oe1.aarch64",
					"name":"libcurl-devel-7.71.1-19.oe1.aarch64 as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"curl-debuginfo-7.71.1-19.oe1.aarch64.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:curl-debuginfo-7.71.1-19.oe1.aarch64",
					"name":"curl-debuginfo-7.71.1-19.oe1.aarch64 as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"libcurl-7.71.1-19.oe1.aarch64.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:libcurl-7.71.1-19.oe1.aarch64",
					"name":"libcurl-7.71.1-19.oe1.aarch64 as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"curl-debugsource-7.71.1-19.oe1.aarch64.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:curl-debugsource-7.71.1-19.oe1.aarch64",
					"name":"curl-debugsource-7.71.1-19.oe1.aarch64 as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"curl-7.71.1-19.oe1.aarch64.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.aarch64",
					"name":"curl-7.71.1-19.oe1.aarch64 as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"curl-help-7.71.1-19.oe1.noarch.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:curl-help-7.71.1-19.oe1.noarch",
					"name":"curl-help-7.71.1-19.oe1.noarch as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"curl-7.71.1-19.oe1.src.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.src",
					"name":"curl-7.71.1-19.oe1.src as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"curl-debuginfo-7.71.1-19.oe1.x86_64.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:curl-debuginfo-7.71.1-19.oe1.x86_64",
					"name":"curl-debuginfo-7.71.1-19.oe1.x86_64 as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"libcurl-devel-7.71.1-19.oe1.x86_64.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:libcurl-devel-7.71.1-19.oe1.x86_64",
					"name":"libcurl-devel-7.71.1-19.oe1.x86_64 as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"curl-7.71.1-19.oe1.x86_64.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.x86_64",
					"name":"curl-7.71.1-19.oe1.x86_64 as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"curl-debugsource-7.71.1-19.oe1.x86_64.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:curl-debugsource-7.71.1-19.oe1.x86_64",
					"name":"curl-debugsource-7.71.1-19.oe1.x86_64 as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"libcurl-7.71.1-19.oe1.x86_64.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:libcurl-7.71.1-19.oe1.x86_64",
					"name":"libcurl-7.71.1-19.oe1.x86_64 as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2022-32221",
			"notes":[
				{
					"text":"A vulnerability was found in curl. The issue occurs when doing HTTP(S) transfers, where curl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set if it previously used the same handle to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-20.03-LTS-SP1:libcurl-devel-7.71.1-19.oe1.aarch64",
					"openEuler-20.03-LTS-SP1:curl-debuginfo-7.71.1-19.oe1.aarch64",
					"openEuler-20.03-LTS-SP1:libcurl-7.71.1-19.oe1.aarch64",
					"openEuler-20.03-LTS-SP1:curl-debugsource-7.71.1-19.oe1.aarch64",
					"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.aarch64",
					"openEuler-20.03-LTS-SP1:curl-help-7.71.1-19.oe1.noarch",
					"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.src",
					"openEuler-20.03-LTS-SP1:curl-debuginfo-7.71.1-19.oe1.x86_64",
					"openEuler-20.03-LTS-SP1:libcurl-devel-7.71.1-19.oe1.x86_64",
					"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.x86_64",
					"openEuler-20.03-LTS-SP1:curl-debugsource-7.71.1-19.oe1.x86_64",
					"openEuler-20.03-LTS-SP1:libcurl-7.71.1-19.oe1.x86_64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-20.03-LTS-SP1:libcurl-devel-7.71.1-19.oe1.aarch64",
						"openEuler-20.03-LTS-SP1:curl-debuginfo-7.71.1-19.oe1.aarch64",
						"openEuler-20.03-LTS-SP1:libcurl-7.71.1-19.oe1.aarch64",
						"openEuler-20.03-LTS-SP1:curl-debugsource-7.71.1-19.oe1.aarch64",
						"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.aarch64",
						"openEuler-20.03-LTS-SP1:curl-help-7.71.1-19.oe1.noarch",
						"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.src",
						"openEuler-20.03-LTS-SP1:curl-debuginfo-7.71.1-19.oe1.x86_64",
						"openEuler-20.03-LTS-SP1:libcurl-devel-7.71.1-19.oe1.x86_64",
						"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.x86_64",
						"openEuler-20.03-LTS-SP1:curl-debugsource-7.71.1-19.oe1.x86_64",
						"openEuler-20.03-LTS-SP1:libcurl-7.71.1-19.oe1.x86_64"
					],
					"details":"curl security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2039"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":4.8,
						"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-20.03-LTS-SP1:libcurl-devel-7.71.1-19.oe1.aarch64",
						"openEuler-20.03-LTS-SP1:curl-debuginfo-7.71.1-19.oe1.aarch64",
						"openEuler-20.03-LTS-SP1:libcurl-7.71.1-19.oe1.aarch64",
						"openEuler-20.03-LTS-SP1:curl-debugsource-7.71.1-19.oe1.aarch64",
						"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.aarch64",
						"openEuler-20.03-LTS-SP1:curl-help-7.71.1-19.oe1.noarch",
						"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.src",
						"openEuler-20.03-LTS-SP1:curl-debuginfo-7.71.1-19.oe1.x86_64",
						"openEuler-20.03-LTS-SP1:libcurl-devel-7.71.1-19.oe1.x86_64",
						"openEuler-20.03-LTS-SP1:curl-7.71.1-19.oe1.x86_64",
						"openEuler-20.03-LTS-SP1:curl-debugsource-7.71.1-19.oe1.x86_64",
						"openEuler-20.03-LTS-SP1:libcurl-7.71.1-19.oe1.x86_64"
					]
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2022-32221"
		}
	]
}