CVE-2021-22897Medium· 5.3▾ TwilightPoC availablecurl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a sin…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.9 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.0%
Exploit / PoC code exists
3.0% → 4.3%
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
curl >= 7.61.0, <= 7.76.1communications_cloud_native_core_binding_support_function = 1.11.0communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0communications_cloud_native_core_network_repository_function = 1.15.0communications_cloud_native_core_network_repository_function = 1.15.1communications_cloud_native_core_network_slice_selection_function = 1.8.0communications_cloud_native_core_service_communication_proxy = 1.15.0essbase < 11.1.2.4.047essbase >= 21.0, < 21.3mysql_server <= 5.7.34mysql_server >= 8.0.0, <= 8.0.25cloud_backupsolidfire,_enterprise_sds_&_hci_storage_nodesolidfire_&_hci_management_nodesolidfire_baseboard_management_controller_firmwarehci_compute_node_firmwareh300e_firmwareh300s_firmwareh410s_firmwareh500e_firmwareh500s_firmwareh700e_firmwareh700s_firmwaresinec_infrastructure_network_services < 1.0.1.1universal_forwarder >= 8.2.0, < 8.2.12universal_forwarder >= 9.0.0, < 9.0.6universal_forwarder = 9.1.0Upgrade past the affected range:
essbase 21.3sinec_infrastructure_network_services 1.0.1.1universal_forwarder 9.0.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-22926High· 7.5libcurl-using applications can ask for a specific client certificate to be used in a transfer
CVE-2021-22922Medium· 6.5When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of diff…
CVE-2021-22947Medium· 5.9When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches
CVE-2021-22946High· 7.5A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withli…
CVE-2021-22925Medium· 5.3curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl
CVE-2021-22898Low· 3.1curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers