CVE-2022-35252low
Description
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
References
https://hackerone.com/reports/1613943
https://security.netapp.com/advisory/ntap-20220930-0005/
https://security.gentoo.org/glsa/202212-01
https://support.apple.com/kb/HT213604
https://support.apple.com/kb/HT213603
http://seclists.org/fulldisclosure/2023/Jan/21
http://seclists.org/fulldisclosure/2023/Jan/20
https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html