CVE-2022-43552 Curl Vulnerability with Windows Server

Question

Hi everyone,

Nessus found a vulnerability with Curl. It looks like Windows Server 2019 uses version 7.83.1.0 which is vulnerable.

Does microsoft plan to release a patch?
Is it possible to install a new version?

Ref:

https://curl.se/docs/CVE-2022-43552.html

Answer 1

The issue is resolved with April, 11th round of updates for all supported operating systems. (e.g., KB5025229 for Windows Server 2019, KB5025230 for Windows Server 2022.) The inbox version of curl.exe (located at %WinDir%\System32\curl.exe) has been updated to version 8.0.1 which addresses CVE-2022-43552. Note that if some other software installed curl.exe to another location, it needs to be updated separately.

Answer 2

There is already a discussion about this here. This forum is for Q&A not really for CVE questions. Perhaps you should go here to check the status of any CVE for Server 2019.