CVE-2021-22924

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

• haxx libcurl (>= 7.10.4 < 7.77.0) • fedoraproject fedora 33 • debian debian linux 9.0 • debian debian linux 10.0 • debian debian linux 11.0 • netapp cloud backup • netapp clustered data ontap • netapp solidfire \& hci management node • netapp solidfire baseboard management controller firmware • oracle mysql server (>= 5.7.0 <= 5.7.36) • oracle mysql server (>= 8.0.0 <= 8.0.26) • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise peopletools 8.59 • siemens sinec infrastructure network services (< 1.0.1.1) • siemens sinema remote connect server (< 3.1) • siemens logo\! cmr2040 firmware • siemens logo\! cmr2020 firmware • siemens ruggedcomrm 1224 lte firmware (< 7.1) • siemens scalance m804pb firmware (< 7.1) • siemens scalance m812-1 firmware (< 7.1) • siemens scalance m816-1 firmware (< 7.1) • siemens scalance m826-2 firmware (< 7.1) • siemens scalance m874-2 firmware (< 7.1) • siemens scalance m874-3 firmware (< 7.1) • siemens scalance m876-3 firmware (< 7.1) • siemens scalance m876-4 firmware (< 7.1) • siemens scalance mum856-1 firmware (< 7.1) • siemens scalance s615 firmware (< 7.1) • siemens simatic cp 1543-1 firmware (< 3.0.22) • siemens simatic cp 1545-1 firmware (< 1.1) • siemens simatic rtu3010c firmware (< 5.0.14) • siemens simatic rtu3030c firmware (< 5.0.14) • siemens simatic rtu3031c firmware (< 5.0.14) • siemens simatic rtu 3041c firmware (< 5.0.14) • siemens sinema remote connect (< 3.1) • siemens siplus net cp 1543-1 firmware (< 3.0.22) • splunk universal forwarder (>= 8.2.0 < 8.2.12) • splunk universal forwarder (>= 9.0.0 < 9.0.6) • splunk universal forwarder 9.1.0