CVEvulnerability

CVE-2021-22946

7.5 HIGH Published 2021-09-29 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2021-09-29
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-319, CWE-325

Description

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Affected configurations

• haxx curl (>= 7.20.0 < 7.79.0) • debian debian linux 9.0 • debian debian linux 10.0 • debian debian linux 11.0 • fedoraproject fedora 33 • fedoraproject fedora 35 • netapp cloud backup • netapp clustered data ontap • netapp oncommand insight • netapp oncommand workflow automation • netapp snapcenter • netapp h300s firmware • netapp h500s firmware • netapp h700s firmware • netapp h300e firmware • netapp h500e firmware • netapp h700e firmware • netapp h410s firmware • netapp solidfire baseboard management controller firmware • oracle communications cloud native core binding support function 1.11.0 • oracle communications cloud native core network function cloud native environment 1.10.0 • oracle communications cloud native core network repository function 1.15.0 • oracle communications cloud native core network repository function 1.15.1 • oracle communications cloud native core network slice selection function 1.8.0 • oracle communications cloud native core service communication proxy 1.15.0 • oracle mysql server (>= 5.7.0 <= 5.7.35) • oracle mysql server (>= 8.0.0 <= 8.0.26) • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise peopletools 8.59 • apple macos (< 12.3) • siemens sinec infrastructure network services (< 1.0.1.1) • oracle commerce guided search 11.3.2 • oracle communications cloud native core binding support function 22.1.3 • oracle communications cloud native core console 22.2.0 • oracle communications cloud native core network repository function 22.1.0 • oracle communications cloud native core network repository function 22.2.0 • oracle communications cloud native core security edge protection proxy 22.1.1 • splunk universal forwarder (>= 8.2.0 < 8.2.12) • splunk universal forwarder (>= 9.0.0 < 9.0.6) • splunk universal forwarder 9.1.0

Related

Weakness · CWE (2)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness
  • CWE-325 Missing Cryptographic Step weakness

References