Log in Start free

Vulnerability · Published Sep 29, 2021 · Assigned by hackerone

CVE-2021-22946

High 7.5

In plain English

A high-severity security flaw in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.5% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)4.5%top 8.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20curl7.79.0-r0ALPINE-CVE-2021-22946
Alpine:v3.21curl7.79.0-r0ALPINE-CVE-2021-22946
Alpine:v3.22curl7.79.0-r0ALPINE-CVE-2021-22946
Alpine:v3.23curl7.79.0-r0ALPINE-CVE-2021-22946
Alpine:v3.24curl7.79.0-r0ALPINE-CVE-2021-22946
Debian:12curl7.79.1-1DEBIAN-CVE-2021-22946
Debian:13curl7.79.1-1DEBIAN-CVE-2021-22946
Debian:14curl7.79.1-1DEBIAN-CVE-2021-22946
Rocky Linux:8curl0:7.61.1-18.el8_4.2RLSA-2021:4059
Ubuntu:22.04:LTScurl7.74.0-1.3ubuntu2UBUNTU-CVE-2021-22946

Affected products (as reported)

VendorProductVersions
n/a https://github.com/curl/curl curl 7.20.0 to and including 7.78.0

Weakness: CWE-325, CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References