CVE-2021-22946
This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 4.54% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-325, CWE-319
- Affected
- haxx/curl · debian/debian linux · fedoraproject/fedora · netapp/cloud backup · netapp/clustered data ontap · netapp/oncommand insight · netapp/oncommand workflow automation · netapp/snapcenter · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h300e firmware · netapp/h500e firmware · netapp/h700e firmware · netapp/h410s firmware · netapp/solidfire baseboard management controller firmware · oracle/communications cloud native core binding support function · oracle/communications cloud native core network function cloud native environment · oracle/communications cloud native core network repository function · oracle/communications cloud native core network slice selection function · +9 more
- Source
- support@hackerone.com
References
- http://seclists.org/fulldisclosure/2022/Mar/29Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
- https://hackerone.com/reports/1334111Exploit, Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/09/msg00022.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211029-0003/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220121-0008/Third Party Advisory
- https://support.apple.com/kb/HT213183Release Notes, Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Mar/29Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
- https://hackerone.com/reports/1334111Exploit, Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/09/msg00022.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211029-0003/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220121-0008/Third Party Advisory
- https://support.apple.com/kb/HT213183Release Notes, Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.