When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
Cuando en curl versiones posteriores a 7.20.0 incluyéndola, y versiones anteriores a 7.78.0 incluyéndola, se conecta a un servidor IMAP o POP3 para recuperar datos usando STARTTLS para actualizar a la seguridad TLS, el servidor puede responder y enviar múltiples respuestas a la vez que curl almacena en caché. curl entonces actualizaría a TLS pero no vaciaría la cola de respuestas almacenadas en caché, sino que continuaría usando y confiando en las respuestas que obtuvo *antes* del protocolo de enlace TLS como si estuvieran autenticadas. Usando este fallo, permite a un atacante de tipo Man-In-The-Middle inyectar primero las respuestas falsas, luego pasar mediante el tráfico TLS del servidor legítimo y engañar a curl para que envíe datos de vuelta al usuario pensando que los datos inyectados por el atacante provienen del servidor protegido por TLS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
AV:N/AC:M/Au:N/C:N/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-310
|
| [email protected] | Primary |
en
CWE-345
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | * | <built-in method update of dict object at 0x7fd34088c300> | Application |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd36b381e80> | Operating System |
| fedoraproject | fedora | 35 | <built-in method update of dict object at 0x7fd36ac49a40> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7fd36b382500> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd34088f400> | Operating System |
| debian | debian_linux | 11.0 | <built-in method update of dict object at 0x7fd34088d8c0> | Operating System |
| netapp | cloud_backup | - | <built-in method update of dict object at 0x7fd34088d380> | Application |
| netapp | clustered_data_ontap | - | <built-in method update of dict object at 0x7fd34088f040> | Application |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd34088f740> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd37019c880> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd34088cc40> | Operating System |
| netapp | h300e_firmware | - | <built-in method update of dict object at 0x7fd348c90cc0> | Operating System |
| netapp | h500e_firmware | - | <built-in method update of dict object at 0x7fd34088c4c0> | Operating System |
| netapp | h700e_firmware | - | <built-in method update of dict object at 0x7fd36ac4b540> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd37034ddc0> | Operating System |
| netapp | solidfire_baseboard_management_controller_firmware | - | <built-in method update of dict object at 0x7fd36b260680> | Operating System |
| oracle | communications_cloud_native_core_binding_support_function | 1.11.0 | <built-in method update of dict object at 0x7fd36b383c80> | Application |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | <built-in method update of dict object at 0x7fd3840e5680> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 1.15.0 | <built-in method update of dict object at 0x7fd340176100> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 1.15.1 | <built-in method update of dict object at 0x7fd36b89c640> | Application |
| oracle | communications_cloud_native_core_network_slice_selection_function | 1.8.0 | <built-in method update of dict object at 0x7fd36b89c7c0> | Application |
| oracle | communications_cloud_native_core_service_communication_proxy | 1.15.0 | <built-in method update of dict object at 0x7fd368d34a80> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd384626f80> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd348c937c0> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.57 | <built-in method update of dict object at 0x7fd384624c40> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.58 | <built-in method update of dict object at 0x7fd2d399ac00> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.59 | <built-in method update of dict object at 0x7fd384625d00> | Application |
| siemens | sinec_infrastructure_network_services | * | <built-in method update of dict object at 0x7fd36043ba40> | Application |
| apple | macos | * | <built-in method update of dict object at 0x7fd384625540> | Operating System |
| oracle | commerce_guided_search | 11.3.2 | <built-in method update of dict object at 0x7fd36b89e880> | Application |
| oracle | communications_cloud_native_core_binding_support_function | 22.1.3 | <built-in method update of dict object at 0x7fd2d3af5840> | Application |
| oracle | communications_cloud_native_core_console | 22.2.0 | <built-in method update of dict object at 0x7fd368d35580> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 22.1.2 | <built-in method update of dict object at 0x7fd36ac48640> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 22.2.0 | <built-in method update of dict object at 0x7fd39c4e75c0> | Application |
| oracle | communications_cloud_native_core_security_edge_protection_proxy | 22.1.1 | <built-in method update of dict object at 0x7fd3840e5880> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd36b89e9c0> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd36ac4aec0> | Application |
| splunk | universal_forwarder | 9.1.0 | <built-in method update of dict object at 0x7fd2dbd50880> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |