CVE-2021-22898Low· 3.1▾ TwilightPoC availablecurl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser f…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 17.1 · likelihood 0.9 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
4.5%
Exploit / PoC code exists
curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
curl >= 7.7, <= 7.76.1debian_linux = 9.0fedora = 33fedora = 34communications_cloud_native_core_binding_support_function = 1.11.0communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0communications_cloud_native_core_network_repository_function = 1.15.0communications_cloud_native_core_network_repository_function = 1.15.1communications_cloud_native_core_network_slice_selection_function = 1.8.0communications_cloud_native_core_service_communication_proxy = 1.15.0essbase < 11.1.2.4.047essbase >= 21.0, < 21.3mysql_server < 5.7.34mysql_server >= 8.0.15, < 8.0.25sinec_infrastructure_network_services < 1.0.1.1universal_forwarder >= 8.2.0, < 8.2.12universal_forwarder >= 9.0.0, < 9.0.6universal_forwarder = 9.1.0Upgrade past the affected range:
essbase 21.3mysql_server 8.0.25sinec_infrastructure_network_services 1.0.1.1universal_forwarder 9.0.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-22925Medium· 5.3curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl
CVE-2020-8284Low· 3.7A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and n…
CVE-2022-27775High· 7.5An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
CVE-2020-8169High· 7.5curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
CVE-2022-32207Critical· 9.8When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accide…
CVE-2022-32208Medium· 5.9When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly