İçeriğe geç
Bilgi ve Teknoloji Uygulamada aç

Orta CVSS 5.3 PoC var

CVE-2021-22925: Curl: hassas bilgi ifşası

Yayın: · Güncelleme:

Açıklama (NVD)

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

Özet bilgiler

Ürün
Haxx Curl
CVSS v3.1
5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
%5,37 (yüzdelik 93)
CWE
CWE-200
Yama
Mevcut

Etkilenen sürümler

ÜrünBaşlangıçBitişDüzeltildi
haxx-curl7.7—7.78.0
fedoraproject-fedora3333—
netapp-cloud-backup———
netapp-clustered-data-ontap———
netapp-hci-management-node———
netapp-solidfire———
apple-mac-os-x10.15.710.15.7—
apple-mac-os-x10.15.710.15.7—
apple-mac-os-x10.15.710.15.7—
apple-mac-os-x10.15.710.15.7—
apple-mac-os-x10.15.710.15.7—
apple-macos11.011.0—
apple-macos11.0.111.0.1—
apple-macos11.111.1—
apple-macos11.1.011.1.0—
apple-macos11.211.2—
apple-macos11.2.111.2.1—
apple-macos11.311.3—
apple-macos11.3.111.3.1—
apple-macos11.411.4—
apple-macos11.511.5—
oracle-mysql-server5.7.05.7.35—
oracle-mysql-server8.0.08.0.26—
oracle-peoplesoft-enterprise-peopletools8.578.57—
oracle-peoplesoft-enterprise-peopletools8.588.58—
oracle-peoplesoft-enterprise-peopletools8.598.59—
siemens-sinec-infrastructure-network-services——1.0.1.1
siemens-sinema-remote-connect-server——3.1
netapp-h300s-firmware———
netapp-h500s-firmware———

Kaynaklar

Uygulamada aç Tüm CVE kayıtları