CVE-2021-22897

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

• haxx curl (>= 7.61.0 <= 7.76.1) • oracle communications cloud native core binding support function 1.11.0 • oracle communications cloud native core network function cloud native environment 1.10.0 • oracle communications cloud native core network repository function 1.15.0 • oracle communications cloud native core network repository function 1.15.1 • oracle communications cloud native core network slice selection function 1.8.0 • oracle communications cloud native core service communication proxy 1.15.0 • oracle essbase (< 11.1.2.4.047) • oracle essbase (>= 21.0 < 21.3) • oracle mysql server (<= 5.7.34) • oracle mysql server (>= 8.0.0 <= 8.0.25) • netapp cloud backup • netapp solidfire\, enterprise sds \& hci storage node • netapp solidfire \& hci management node • netapp solidfire baseboard management controller firmware • netapp hci compute node firmware • netapp h300e firmware • netapp h300s firmware • netapp h410s firmware • netapp h500e firmware • netapp h500s firmware • netapp h700e firmware • netapp h700s firmware • siemens sinec infrastructure network services (< 1.0.1.1) • splunk universal forwarder (>= 8.2.0 < 8.2.12) • splunk universal forwarder (>= 9.0.0 < 9.0.6) • splunk universal forwarder 9.1.0