Strix
26.1K

CVE-2021-22947

MEDIUMCVSS 5.9/10EPSS 2.80%

Last modified

CVE-2021-22947 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.. EPSS estimates a 2.80% chance of exploitation in the next 30 days.

Description

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Metrics

CVSS 3.1
5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Probability
2.80%

84.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HaxxCurl>= 7.20.0, < 7.79.0
FedoraprojectFedora33
FedoraprojectFedora35
DebianDebian Linux9.0
DebianDebian Linux10.0
DebianDebian Linux11.0
NetappCloud BackupAll versions
NetappClustered Data OntapAll versions
NetappH300s FirmwareAll versions
NetappH500s FirmwareAll versions
NetappH700s FirmwareAll versions
NetappH300e FirmwareAll versions
NetappH500e FirmwareAll versions
NetappH700e FirmwareAll versions
NetappH410s FirmwareAll versions
NetappSolidfire Baseboard Management Controller FirmwareAll versions
OracleCommunications Cloud Native Core Binding Support Function1.11.0
OracleCommunications Cloud Native Core Network Function Cloud Native Environment1.10.0
OracleCommunications Cloud Native Core Network Repository Function1.15.0
OracleCommunications Cloud Native Core Network Repository Function1.15.1
OracleCommunications Cloud Native Core Network Slice Selection Function1.8.0
OracleCommunications Cloud Native Core Service Communication Proxy1.15.0
OracleMysql Server>= 5.7.0, <= 5.7.35
OracleMysql Server>= 8.0.0, <= 8.0.26
OraclePeoplesoft Enterprise Peopletools8.57
OraclePeoplesoft Enterprise Peopletools8.58
OraclePeoplesoft Enterprise Peopletools8.59
SiemensSinec Infrastructure Network Services< 1.0.1.1
AppleMacos< 12.3
OracleCommerce Guided Search11.3.2
OracleCommunications Cloud Native Core Binding Support Function22.1.3
OracleCommunications Cloud Native Core Console22.2.0
OracleCommunications Cloud Native Core Network Repository Function22.1.2
OracleCommunications Cloud Native Core Network Repository Function22.2.0
OracleCommunications Cloud Native Core Security Edge Protection Proxy22.1.1
SplunkUniversal Forwarder>= 8.2.0, < 8.2.12
SplunkUniversal Forwarder>= 9.0.0, < 9.0.6
SplunkUniversal Forwarder9.1.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-22947?
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
How severe is CVE-2021-22947?
CVE-2021-22947 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 2.80% probability of exploitation in the next 30 days.
How do I fix CVE-2021-22947?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-22947?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST