Yüksek CVSS 7.5 PoC var
CVE-2021-22946: Curl: güvenlik açığı
Açıklama (NVD)
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
Özet bilgiler
- Ürün
- Haxx Curl
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- %4,54 (yüzdelik 92)
- CWE
- CWE-325
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| haxx-curl | 7.20.0 | — | 7.79.0 |
| debian-debian-linux | 9.0 | 9.0 | — |
| debian-debian-linux | 10.0 | 10.0 | — |
| debian-debian-linux | 11.0 | 11.0 | — |
| fedoraproject-fedora | 33 | 33 | — |
| fedoraproject-fedora | 35 | 35 | — |
| netapp-cloud-backup | — | — | — |
| netapp-clustered-data-ontap | — | — | — |
| netapp-oncommand-insight | — | — | — |
| netapp-oncommand-workflow-automation | — | — | — |
| netapp-snapcenter | — | — | — |
| netapp-h300s-firmware | — | — | — |
| netapp-h500s-firmware | — | — | — |
| netapp-h700s-firmware | — | — | — |
| netapp-h300e-firmware | — | — | — |
| netapp-h500e-firmware | — | — | — |
| netapp-h700e-firmware | — | — | — |
| netapp-h410s-firmware | — | — | — |
| netapp-solidfire-baseboard-management-controller-firmware | — | — | — |
| oracle-communications-cloud-native-core-binding-support-function | 1.11.0 | 1.11.0 | — |
| oracle-communications-cloud-native-core-network-function-cloud-native-environment | 1.10.0 | 1.10.0 | — |
| oracle-communications-cloud-native-core-network-repository-function | 1.15.0 | 1.15.0 | — |
| oracle-communications-cloud-native-core-network-repository-function | 1.15.1 | 1.15.1 | — |
| oracle-communications-cloud-native-core-network-slice-selection-function | 1.8.0 | 1.8.0 | — |
| oracle-communications-cloud-native-core-service-communication-proxy | 1.15.0 | 1.15.0 | — |
| oracle-mysql-server | 5.7.0 | 5.7.35 | — |
| oracle-mysql-server | 8.0.0 | 8.0.26 | — |
| oracle-peoplesoft-enterprise-peopletools | 8.57 | 8.57 | — |
| oracle-peoplesoft-enterprise-peopletools | 8.58 | 8.58 | — |
| oracle-peoplesoft-enterprise-peopletools | 8.59 | 8.59 | — |
Kaynaklar
- NVD kaydı
- seclists.org
- cert-portal.siemens.com
- hackerone.com
- lists.debian.org
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.gentoo.org
- security.netapp.com
- security.netapp.com
- support.apple.com
- www.debian.org
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- seclists.org
- cert-portal.siemens.com
- hackerone.com
- lists.debian.org
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.gentoo.org
- CWE-325