CVE-2022-32208: 
Splunk Forwarder vulnerability analysis and mitigation

When curl < 7.84.0 performs FTP transfers secured by krb5, it handles message verification failures incorrectly. This vulnerability (CVE-2022-32208) was introduced in curl 7.16.4 and makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows data injection to the client (Curl Docs).

The vulnerability typically causes curl to insert 599 (+ terminating null) bytes into the data where it detects the error, followed by the attacker's data. This requires attackers to handle this initial hard-coded 5-byte sequence of 'junk' in their exploit. The vulnerability affects FTP-KRB, which is noted as a rarely used feature. The issue is classified as CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel (Curl Docs).

The vulnerability enables Man-in-the-Middle (MITM) attacks to go undetected and allows attackers to inject data to the client. This poses a significant security risk as it compromises the integrity of data transfers and enables potential malicious data injection (Curl Docs, Ubuntu Security).

The vulnerability was fixed in curl version 7.84.0. Users are recommended to either upgrade to curl version 7.84.0 or later, apply the available patch to their local version, or avoid using KRB-FTP. The fix was implemented through commit 6ecdf5136b52af7 (Curl Docs).