Vulnerability
curl/libcurl: curl removes wrong file on error
curl might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. The `--remove-on-error` option tells curl to remove the output file when it returns an error, and not leave a partial file behind. The `--no-clobber` option prevents curl from overwriting a file if it already exists, and instead appends a number to the name to create a new unused filename. If curl adds a number to not "clobber" the output and an error occurs during transfer, the remove on error logic would remove the *original* filename without the added number.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:HMid-pack — moderate exploitation likelihood.
No VEX statements published for CVE-2022-27778. Vendors publish VEX (Vulnerability Exploitability eXchange) to assert per-product whether a CVE is actually exploitable in their distribution.
Total impact on non-trivial mission systems