Vulnerability · Published Sep 29, 2021 · Assigned by hackerone
CVE-2021-22947
Medium 5.9
In plain English
A medium-severity security flaw in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | curl | 7.79.0-r0 | ALPINE-CVE-2021-22947 |
| Alpine:v3.21 | curl | 7.79.0-r0 | ALPINE-CVE-2021-22947 |
| Alpine:v3.22 | curl | 7.79.0-r0 | ALPINE-CVE-2021-22947 |
| Alpine:v3.23 | curl | 7.79.0-r0 | ALPINE-CVE-2021-22947 |
| Alpine:v3.24 | curl | 7.79.0-r0 | ALPINE-CVE-2021-22947 |
| Debian:12 | curl | 7.79.1-1 | DEBIAN-CVE-2021-22947 |
| Debian:13 | curl | 7.79.1-1 | DEBIAN-CVE-2021-22947 |
| Debian:14 | curl | 7.79.1-1 | DEBIAN-CVE-2021-22947 |
| Rocky Linux:8 | curl | 0:7.61.1-18.el8_4.2 | RLSA-2021:4059 |
| Ubuntu:22.04:LTS | curl | 7.74.0-1.3ubuntu2 | UBUNTU-CVE-2021-22947 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/curl/curl | curl 7.20.0 to and including 7.78.0 |
Weakness: CWE-310 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://hackerone.com/reports/1334763
- [debian-lts-announce] 20210930 [SECURITY] [DLA 2773-1] curl security update mailing-list
- FEDORA-2021-fc96a3a749 vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html
- FEDORA-2021-1d24845e93 vendor-advisory
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://security.netapp.com/advisory/ntap-20211029-0003/
- 20220314 APPLE-SA-2022-03-14-4 macOS Monterey 12.3 mailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://support.apple.com/kb/HT213183
- https://www.oracle.com/security-alerts/cpujul2022.html
- DSA-5197 vendor-advisory
- [debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update mailing-list
- GLSA-202212-01 vendor-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html