Strix
26.1K

CVE-2021-22926

HIGHCVSS 7.5/10EPSS 9.82%

Last modified

CVE-2021-22926 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. EPSS estimates a 9.82% chance of exploitation in the next 30 days.

Description

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
9.82%

94.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HaxxCurl>= 7.33.0, < 7.78.0
NetappActive Iq Unified ManagerAll versions
NetappClustered Data OntapAll versions
NetappHci Management NodeAll versions
NetappOncommand InsightAll versions
NetappOncommand Workflow AutomationAll versions
NetappSnapcenterAll versions
NetappSolidfireAll versions
OracleMysql Server>= 5.7.0, <= 5.7.35
OracleMysql Server>= 8.0.0, <= 8.0.26
OraclePeoplesoft Enterprise Peopletools8.57
OraclePeoplesoft Enterprise Peopletools8.58
OraclePeoplesoft Enterprise Peopletools8.59
SiemensSinec Infrastructure Network Services< 1.0.1.1
NetappH300s FirmwareAll versions
NetappH300e FirmwareAll versions
NetappH500e FirmwareAll versions
NetappH500s FirmwareAll versions
NetappH700s FirmwareAll versions
NetappH700e FirmwareAll versions
NetappH410s FirmwareAll versions
SplunkUniversal Forwarder>= 8.2.0, < 8.2.12
SplunkUniversal Forwarder>= 9.0.0, < 9.0.6
SplunkUniversal Forwarder9.1.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-22926?
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.
How severe is CVE-2021-22926?
CVE-2021-22926 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 9.82% probability of exploitation in the next 30 days.
How do I fix CVE-2021-22926?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-22926?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST