Strix
26.1K

CVE-2021-22897

MEDIUMCVSS 5.3/10EPSS 2.98%

Last modified

CVE-2021-22897 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. EPSS estimates a 2.98% chance of exploitation in the next 30 days.

Description

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Probability
2.98%

85.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HaxxCurl>= 7.61.0, <= 7.76.1
OracleCommunications Cloud Native Core Binding Support Function1.11.0
OracleCommunications Cloud Native Core Network Function Cloud Native Environment1.10.0
OracleCommunications Cloud Native Core Network Repository Function1.15.0
OracleCommunications Cloud Native Core Network Repository Function1.15.1
OracleCommunications Cloud Native Core Network Slice Selection Function1.8.0
OracleCommunications Cloud Native Core Service Communication Proxy1.15.0
OracleEssbase< 11.1.2.4.047
OracleEssbase>= 21.0, < 21.3
OracleMysql Server<= 5.7.34
OracleMysql Server>= 8.0.0, <= 8.0.25
NetappCloud BackupAll versions
NetappSolidfire\, Enterprise Sds \& Hci Storage NodeAll versions
NetappSolidfire \& Hci Management NodeAll versions
NetappSolidfire Baseboard Management Controller FirmwareAll versions
NetappHci Compute Node FirmwareAll versions
NetappH300e FirmwareAll versions
NetappH300s FirmwareAll versions
NetappH410s FirmwareAll versions
NetappH500e FirmwareAll versions
NetappH500s FirmwareAll versions
NetappH700e FirmwareAll versions
NetappH700s FirmwareAll versions
SiemensSinec Infrastructure Network Services< 1.0.1.1
SplunkUniversal Forwarder>= 8.2.0, < 8.2.12
SplunkUniversal Forwarder>= 9.0.0, < 9.0.6
SplunkUniversal Forwarder9.1.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-22897?
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
How severe is CVE-2021-22897?
CVE-2021-22897 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 2.98% probability of exploitation in the next 30 days.
How do I fix CVE-2021-22897?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-22897?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST