Low severity · published Aug 5, 2021
CVE-2021-22924
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching…
3.7
CVSS
6.3%
EPSS
No
On KEV
Description
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
https://github.com/curl/curl ·
curl 7.10.4 to and include curl 7.77.0 · source: vendor
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
CD
Clustered Data Ontap · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
9.0; 10.0; 11.0 · source: NVD
FE
Fedora · Fedoraproject
33 · source: NVD
LI
Libcurl · Haxx
7.10.4 before 7.77.0 · source: NVD
LC
Logo! Cmr2020 Firmware · Siemens
All versions, or not specified · source: NVD
LC
Logo! Cmr2040 Firmware · Siemens
All versions, or not specified · source: NVD
MS
Mysql Server · Oracle
5.7.0 through 5.7.36; 8.0.0 through 8.0.26 · source: NVD
PE
Peoplesoft Enterprise Peopletools · Oracle
8.57; 8.58; 8.59 · source: NVD
R1
Ruggedcomrm 1224 Lte Firmware · Siemens
before 7.1 · source: NVD
SM
Scalance M804pb Firmware · Siemens
before 7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22924
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22924
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf
Exploit
https://hackerone.com/reports/1223565
Mailing List
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E
Mailing List
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E
More from https://github.com/curl/curl
9.8
CVE-2022-32221
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been…
9.8
CVE-2022-32207
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final…
9.1
CVE-2023-23914
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially
9.1
CVE-2021-22945
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in…
8.8
CVE-2023-27534
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in…