Vulnerability · Published Aug 5, 2021 · Assigned by hackerone
CVE-2021-22922
Medium 6.5
In plain English
A medium-severity security flaw in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.3% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | curl | 7.78.0-r0 | ALPINE-CVE-2021-22922 |
| Alpine:v3.21 | curl | 7.78.0-r0 | ALPINE-CVE-2021-22922 |
| Alpine:v3.22 | curl | 7.78.0-r0 | ALPINE-CVE-2021-22922 |
| Alpine:v3.23 | curl | 7.78.0-r0 | ALPINE-CVE-2021-22922 |
| Alpine:v3.24 | curl | 7.78.0-r0 | ALPINE-CVE-2021-22922 |
| Debian:12 | curl | 7.79.1-1 | DEBIAN-CVE-2021-22922 |
| Debian:13 | curl | 7.79.1-1 | DEBIAN-CVE-2021-22922 |
| Debian:14 | curl | 7.79.1-1 | DEBIAN-CVE-2021-22922 |
| Rocky Linux:8 | curl | 0:7.61.1-18.el8_4.1 | RLSA-2021:3582 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/curl/curl | curl 7.27.0 to and including 7.77.0 |
Weakness: CWE-840 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://hackerone.com/reports/1213175
- FEDORA-2021-5d21b90a30 vendor-advisory
- [kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image mailing-list
- [kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image mailing-list
- [kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image mailing-list
- [kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210902-0003/
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- GLSA-202212-01 vendor-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html