IM
IronMonkey Threat Research

CVE-2021-22924 MEDIUM

Published: 2021-08-05 | Last Modified: 2025-06-09 | Status: Modified

Description

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Additional Descriptions (1)

libcurl mantiene las conexiones usadas previamente en un pool de conexiones para reusarlas en posteriores transferencias, si una de ellas coincide con la configuración. Debido a errores en la lógica, la función de coincidencia de la configuración no tenía en cuenta "issuercert" y comparaba las rutas implicadas *sin tener en cuenta el caso*, que podía conllevar a que libcurl reusara conexiones erróneas. Las rutas de los archivos son, o pueden ser, casos confidenciales en muchos sistemas, pero no en todos, y pueden incluso variar dependiendo de los sistemas de archivos usados. La comparación tampoco incluía el "issuercert" que una transferencia puede ajustar para calificar cómo verificar el certificado del servidor

CVSS Metrics

Base Score: 3.7 (LOW)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactLOW
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.2

Impact Score: 1.4

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-20
[email protected] Primary
en CWE-706

Affected Products

Vendor Product Version Update Type
haxx libcurl * <built-in method update of dict object at 0x7fd39c4a7540> Application
fedoraproject fedora 33 <built-in method update of dict object at 0x7fd39c449a80> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd39c4a7640> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd39c4a7a40> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd39c4a6480> Operating System
netapp cloud_backup - <built-in method update of dict object at 0x7fd39c4a7fc0> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd340a92880> Application
netapp solidfire_\&_hci_management_node - <built-in method update of dict object at 0x7fd39c4d2180> Application
netapp solidfire_baseboard_management_controller_firmware - <built-in method update of dict object at 0x7fd384aa2900> Operating System
oracle mysql_server * <built-in method update of dict object at 0x7fd39c4a47c0> Application
oracle mysql_server * <built-in method update of dict object at 0x7fd39c4bbdc0> Application
oracle peoplesoft_enterprise_peopletools 8.57 <built-in method update of dict object at 0x7fd34017da40> Application
oracle peoplesoft_enterprise_peopletools 8.58 <built-in method update of dict object at 0x7fd369407200> Application
oracle peoplesoft_enterprise_peopletools 8.59 <built-in method update of dict object at 0x7fd36041b940> Application
siemens sinec_infrastructure_network_services * <built-in method update of dict object at 0x7fd39c4bae80> Application
siemens sinema_remote_connect_server * <built-in method update of dict object at 0x7fd36b7d70c0> Application
siemens logo\!_cmr2040_firmware * <built-in method update of dict object at 0x7fd2a159d5c0> Operating System
siemens logo\!_cmr2020_firmware * <built-in method update of dict object at 0x7fd39c4a7c80> Operating System
siemens ruggedcomrm_1224_lte_firmware * <built-in method update of dict object at 0x7fd39c4a7e00> Operating System
siemens scalance_m804pb_firmware * <built-in method update of dict object at 0x7fd34017fc80> Operating System
siemens scalance_m812-1_firmware * <built-in method update of dict object at 0x7fd39c4a7680> Operating System
siemens scalance_m816-1_firmware * <built-in method update of dict object at 0x7fd3408d2180> Operating System
siemens scalance_m826-2_firmware * <built-in method update of dict object at 0x7fd2d39fe580> Operating System
siemens scalance_m874-2_firmware * <built-in method update of dict object at 0x7fd2d2495100> Operating System
siemens scalance_m874-3_firmware * <built-in method update of dict object at 0x7fd36041a7c0> Operating System
siemens scalance_m876-3_firmware * <built-in method update of dict object at 0x7fd38674f600> Operating System
siemens scalance_m876-4_firmware * <built-in method update of dict object at 0x7fd38674c400> Operating System
siemens scalance_mum856-1_firmware * <built-in method update of dict object at 0x7fd3604185c0> Operating System
siemens scalance_s615_firmware * <built-in method update of dict object at 0x7fd289dc4600> Operating System
siemens simatic_cp_1543-1_firmware * <built-in method update of dict object at 0x7fd39c4a6880> Operating System
siemens simatic_cp_1545-1_firmware * <built-in method update of dict object at 0x7fd368336040> Operating System
siemens simatic_rtu3010c_firmware * <built-in method update of dict object at 0x7fd340a91280> Operating System
siemens simatic_rtu3030c_firmware * <built-in method update of dict object at 0x7fd3855bd280> Operating System
siemens simatic_rtu3031c_firmware * <built-in method update of dict object at 0x7fd39c4a4940> Operating System
siemens simatic_rtu_3041c_firmware * <built-in method update of dict object at 0x7fd3855be500> Operating System
siemens sinema_remote_connect * <built-in method update of dict object at 0x7fd3606cb400> Application
siemens siplus_net_cp_1543-1_firmware * <built-in method update of dict object at 0x7fd36b7d7c80> Operating System
splunk universal_forwarder * <built-in method update of dict object at 0x7fd2d39fc380> Application
splunk universal_forwarder * <built-in method update of dict object at 0x7fd2dbcbae80> Application
splunk universal_forwarder 9.1.0 <built-in method update of dict object at 0x7fd36b7d7580> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:logo\!_cmr2040_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:logo\!_cmr2040:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:logo\!_cmr2020_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:logo\!_cmr2020:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:ruggedcomrm_1224_lte_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:ruggedcomrm_1224_lte:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_m804pb_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_m804pb:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_m812-1_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_m812-1:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_m816-1_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_m816-1:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_m826-2_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_m826-2:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_m874-2_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_m874-2:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_m874-3_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_m874-3:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_m876-3_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_m876-3:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_m876-4_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_m876-4:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_mum856-1_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_mum856-1:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_s615_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_s615:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_cp_1543-1_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_cp_1543-1:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_cp_1545-1_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_cp_1545-1:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_rtu3010c_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_rtu3010c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_rtu3030c_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_rtu3030c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_rtu3031c_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_rtu3031c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_rtu_3041c_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_rtu_3041c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:sinema_remote_connect:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:siplus_net_cp_1543-1_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:siplus_net_cp_1543-1:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

References