Orta CVSS 6.5 PoC var

CVE-2021-22922: Curl: güvenlik açığı

Yayın: 6 Ağustos 2021 00:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

Özet bilgiler

Ürün: Haxx Curl
CVSS v3.1: 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS: %4,33 (yüzdelik 91)
CWE: CWE-840
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
haxx-curl	7.27.0	—	7.78.0
fedoraproject-fedora	33	33	—
netapp-cloud-backup	—	—	—
netapp-clustered-data-ontap	—	—	—
netapp-hci-management-node	—	—	—
netapp-solidfire	—	—	—
oracle-mysql-server	5.7.0	5.7.35	—
oracle-mysql-server	8.0.0	8.0.26	—
siemens-sinec-infrastructure-network-services	—	—	1.0.1.1
netapp-h300s-firmware	—	—	—
netapp-h500s-firmware	—	—	—
netapp-h700s-firmware	—	—	—
netapp-h300e-firmware	—	—	—
netapp-h500e-firmware	—	—	—
netapp-h700e-firmware	—	—	—
netapp-h410s-firmware	—	—	—
splunk-universal-forwarder	8.2.0	—	8.2.12
splunk-universal-forwarder	9.0.0	—	9.0.6
splunk-universal-forwarder	9.1.0	9.1.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları