Vulnerability Description
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | >= 7.7, < 7.78.0 |
| Fedoraproject | Fedora | 33 |
| Netapp | Cloud Backup | - |
| Netapp | Clustered Data Ontap | - |
| Netapp | Hci Management Node | - |
| Netapp | Solidfire | - |
| Apple | Mac Os X | 10.15.7 |
| Apple | Macos | 11.0 |
| Oracle | Mysql Server | >= 5.7.0, <= 5.7.35 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.57 |
| Siemens | Sinec Infrastructure Network Services | < 1.0.1.1 |
| Siemens | Sinema Remote Connect Server | < 3.1 |
| Netapp | H300S Firmware | - |
| Netapp | H300S | - |
| Netapp | H500S Firmware | - |
| Netapp | H500S | - |
| Netapp | H700S Firmware | - |
| Netapp | H700S | - |
| Netapp | H300E Firmware | - |
| Netapp | H300E | - |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2021/Sep/39Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2021/Sep/40Mailing ListThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatchThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdfThird Party Advisory
- https://hackerone.com/reports/1223882ExploitIssue TrackingPatch
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210902-0003/Third Party Advisory
- https://support.apple.com/kb/HT212804Third Party Advisory
- https://support.apple.com/kb/HT212805Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory
- http://seclists.org/fulldisclosure/2021/Sep/39Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2021/Sep/40Mailing ListThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatchThird Party Advisory
FAQ
What is CVE-2021-22925?
CVE-2021-22925 is a vulnerability with a CVSS score of 5.3 (MEDIUM). curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser...
How severe is CVE-2021-22925?
CVE-2021-22925 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-22925?
Check the references section above for vendor advisories and patch information. Affected products include: Haxx Curl, Fedoraproject Fedora, Netapp Cloud Backup, Netapp Clustered Data Ontap, Netapp Hci Management Node.