Vulnerability · Published Aug 5, 2021 · Assigned by hackerone
CVE-2021-22925
Medium 5.3
In plain English
A medium-severity information exposure in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.4% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | curl | 7.61.1-22.el8 | ALSA-2021:4511 |
| AlmaLinux:8 | libcurl | 7.61.1-22.el8 | ALSA-2021:4511 |
| AlmaLinux:8 | libcurl-devel | 7.61.1-22.el8 | ALSA-2021:4511 |
| AlmaLinux:8 | libcurl-minimal | 7.61.1-22.el8 | ALSA-2021:4511 |
| Alpine:v3.20 | curl | 7.78.0-r0 | ALPINE-CVE-2021-22925 |
| Alpine:v3.21 | curl | 7.78.0-r0 | ALPINE-CVE-2021-22925 |
| Alpine:v3.22 | curl | 7.78.0-r0 | ALPINE-CVE-2021-22925 |
| Alpine:v3.23 | curl | 7.78.0-r0 | ALPINE-CVE-2021-22925 |
| Alpine:v3.24 | curl | 7.78.0-r0 | ALPINE-CVE-2021-22925 |
| Rocky Linux:8 | curl | 0:7.61.1-22.el8 | RLSA-2021:4511 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/curl/curl | curl 7.7 to and including 7.77.0 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://hackerone.com/reports/1223882
- FEDORA-2021-5d21b90a30 vendor-advisory
- 20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina mailing-list
- 20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210902-0003/
- https://support.apple.com/kb/HT212805
- https://support.apple.com/kb/HT212804
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- GLSA-202212-01 vendor-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-484086.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html