SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-22946

This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing…

HIGH 7.5EPSS 4.54%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

CVSS 3.1
7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
4.54% probability · 91th percentile
CISA KEV
Not listed
Weakness
CWE-325, CWE-319
Affected
haxx/curl · debian/debian linux · fedoraproject/fedora · netapp/cloud backup · netapp/clustered data ontap · netapp/oncommand insight · netapp/oncommand workflow automation · netapp/snapcenter · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h300e firmware · netapp/h500e firmware · netapp/h700e firmware · netapp/h410s firmware · netapp/solidfire baseboard management controller firmware · oracle/communications cloud native core binding support function · oracle/communications cloud native core network function cloud native environment · oracle/communications cloud native core network repository function · oracle/communications cloud native core network slice selection function · +9 more
Source
support@hackerone.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.