IM
IronMonkey Threat Research

CVE-2021-22897 MEDIUM

Published: 2021-06-11 | Last Modified: 2026-05-28 | Status: Modified

Description

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

Additional Descriptions (1)

curl versiones 7.61.0 hasta 7.76.1, sufre de exposición de un elemento de datos a una sesión equivocada debido a un error en el código para la función CURLOPT_SSL_CIPHER_LIST cuando libcurl es construído para usar la biblioteca TLS de Schannel. El ajuste de cifrado seleccionado se almacenaba en una única variable "static" en la biblioteca, lo que tiene el sorprendente efecto secundario de que si una aplicación establece múltiples transferencias concurrentes, la última que ajusta los cifrados controlará accidentalmente el ajuste usado por todas las transferencias. En el peor de los casos, esto debilita significativamente la seguridad del transporte

CVSS Metrics

Base Score: 5.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactLOW
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 1.4

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-840
[email protected] Primary
en CWE-668

Affected Products

Vendor Product Version Update Type
haxx curl * <built-in method update of dict object at 0x7fd385057f40> Application
oracle communications_cloud_native_core_binding_support_function 1.11.0 <built-in method update of dict object at 0x7fd385055c00> Application
oracle communications_cloud_native_core_network_function_cloud_native_environment 1.10.0 <built-in method update of dict object at 0x7fd3401d0940> Application
oracle communications_cloud_native_core_network_repository_function 1.15.0 <built-in method update of dict object at 0x7fd3855b3500> Application
oracle communications_cloud_native_core_network_repository_function 1.15.1 <built-in method update of dict object at 0x7fd385055780> Application
oracle communications_cloud_native_core_network_slice_selection_function 1.8.0 <built-in method update of dict object at 0x7fd385054600> Application
oracle communications_cloud_native_core_service_communication_proxy 1.15.0 <built-in method update of dict object at 0x7fd38541f800> Application
oracle essbase * <built-in method update of dict object at 0x7fd38541d380> Application
oracle essbase * <built-in method update of dict object at 0x7fd38541c040> Application
oracle mysql_server * <built-in method update of dict object at 0x7fd385056ec0> Application
oracle mysql_server * <built-in method update of dict object at 0x7fd3401d2b40> Application
netapp cloud_backup - <built-in method update of dict object at 0x7fd385054cc0> Application
netapp solidfire\,_enterprise_sds_\&_hci_storage_node - <built-in method update of dict object at 0x7fd34b9c2080> Application
netapp solidfire_\&_hci_management_node - <built-in method update of dict object at 0x7fd3401d3b00> Application
netapp solidfire_baseboard_management_controller_firmware - <built-in method update of dict object at 0x7fd3855b02c0> Operating System
netapp hci_compute_node_firmware - <built-in method update of dict object at 0x7fd2a2248840> Operating System
netapp h300e_firmware - <built-in method update of dict object at 0x7fd385054b80> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd34017e380> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd2a22487c0> Operating System
netapp h500e_firmware - <built-in method update of dict object at 0x7fd36945d500> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd36a655b80> Operating System
netapp h700e_firmware - <built-in method update of dict object at 0x7fd385057a80> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd3401d15c0> Operating System
siemens sinec_infrastructure_network_services * <built-in method update of dict object at 0x7fd340891880> Application
splunk universal_forwarder * <built-in method update of dict object at 0x7fd36944b200> Application
splunk universal_forwarder * <built-in method update of dict object at 0x7fd3855db040> Application
splunk universal_forwarder 9.1.0 <built-in method update of dict object at 0x7fd34017d640> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

References