CVE-2021-22897
Published on: 06/11/2021 12:00:00 AM UTC
Last Modified on: 08/30/2022 09:21:00 PM UTC
Certain versions of Curl from Haxx contain the following vulnerability:
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- CVE-2021-22897 has been assigned by
suppor[email protected] to track the vulnerability - currently rated as MEDIUM severity.
CVSS3 Score: 5.3 - MEDIUM
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | LOW | NONE | NONE |
CVSS2 Score: 4.3 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | MEDIUM | NONE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | NONE | NONE |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| schannel: don't use static to store selected ciphers · curl/curl@bbb7150 · GitHub | github.com text/html |
MISC github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511 |
| Oracle Critical Patch Update Advisory - April 2022 | www.oracle.com text/html |
MISC www.oracle.com/security-alerts/cpuapr2022.html |
| June 2021 cURL/libcURL Vulnerabilities in NetApp Products | NetApp Product Security | security.netapp.com text/html |
CONFIRM security.netapp.com/advisory/ntap-20210727-0007/ |
| Oracle Critical Patch Update Advisory - July 2021 | www.oracle.com text/html |
MISC www.oracle.com//security-alerts/cpujul2021.html |
| Oracle Critical Patch Update Advisory - January 2022 | www.oracle.com text/html |
MISC www.oracle.com/security-alerts/cpujan2022.html |
| curl - schannel cipher selection surprise - CVE-2021-22897 | curl.se text/html |
MISC curl.se/docs/CVE-2021-22897.html |
| cert-portal.siemens.com application/pdf |
CONFIRM cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf | |
| HackerOne | hackerone.com text/html |
MISC hackerone.com/reports/1172857 |
Related QID Numbers
- 296065 Oracle Solaris 11.4 Support Repository Update (SRU) 39.107.1 Missing (CPUOCT2021)
- 378599 Splunk Enterprise Third Party Package Updates for June (SVD-2023-0613)
- 591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
- 670481 EulerOS Security Update for curl (EulerOS-SA-2021-2239)
- 670507 EulerOS Security Update for curl (EulerOS-SA-2021-2265)
- 670532 EulerOS Security Update for curl (EulerOS-SA-2021-2290)
- 900254 CBL-Mariner Linux Security Update for curl 7.76.0
- 900905 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (6358-1)
- 903597 Common Base Linux Mariner (CBL-Mariner) Security Update for curl (4368)
Known Affected Configurations (CPE V2.3)
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*:
- cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @mkviitanen |
libcurl vulnerabilities: curl.se/docs/CVE-2021-… curl.se/docs/CVE-2021-… curl.se/docs/CVE-2021-… | 2021-05-26 06:43:07 |
| @OpenBSD_ports |
naddy@ modified net/curl: net/curl: security update to 7.77.0 Includes fixes for CVE-2021-22897: schannel cipher se… twitter.com/i/web/status/1… | 2021-05-31 20:55:21 |
| @CVEreport |
CVE-2021-22897 : curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake… twitter.com/i/web/status/1… | 2021-06-11 16:13:52 |
| @LinInfoSec |
Curl - CVE-2021-22897: curl.se/docs/CVE-2021-… | 2021-06-11 18:15:24 |
 /r/netcve |
CVE-2021-22897 | 2021-06-11 16:41:55 |