CVE-2021-22925Medium· 5.3▾ TwilightPoC availablecurl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, lib…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 1.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
4.9%
Exploit / PoC code exists
4.9% → 5.4%
curl supports the -t command line option, known as CURLOPT_TELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending NEW_ENV variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
curl >= 7.7, < 7.78.0fedora = 33cloud_backupclustered_data_ontaphci_management_nodesolidfiremac_os_x = 10.15.7macos = 11.0macos = 11.0.1macos = 11.1macos = 11.1.0macos = 11.2macos = 11.2.1macos = 11.3macos = 11.3.1macos = 11.4macos = 11.5mysql_server >= 5.7.0, <= 5.7.35mysql_server >= 8.0.0, <= 8.0.26peoplesoft_enterprise_peopletools = 8.57peoplesoft_enterprise_peopletools = 8.58peoplesoft_enterprise_peopletools = 8.59sinec_infrastructure_network_services < 1.0.1.1sinema_remote_connect_server < 3.1h300s_firmwareh500s_firmwareh700s_firmwareh300e_firmwareh500e_firmwareh700e_firmwareh410s_firmwareuniversal_forwarder >= 8.2.0, < 8.2.12universal_forwarder >= 9.0.0, < 9.0.6universal_forwarder = 9.1.0Upgrade past the affected range:
curl 7.78.0sinec_infrastructure_network_services 1.0.1.1sinema_remote_connect_server 3.1universal_forwarder 9.0.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-32221Critical· 9.8When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PU…
CVE-2021-22898Low· 3.1curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers
CVE-2020-8284Low· 3.7A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and n…
CVE-2022-27775High· 7.5An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
CVE-2020-8169High· 7.5curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
CVE-2022-35260Medium· 6.5curl can be told to parse a `.netrc` file for credentials