CVE-2021-22898
Low
Description
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
SeverityLow
CVSS3.1
Exploit probability—
Product
Haxx Curl
PublishedJun 11, 2021
First seenJun 11, 2021
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- oracle essbase11.1.2.4.047, 21.3 or later
- oracle mysql_server5.7.34, 8.0.25 or later
- siemens sinec_infrastructure_network_services1.0.1.1 or later
- splunk universal_forwarder8.2.12, 9.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| haxx curl | 7.7 ≤ v ≤ 7.76.1 | — |
| debian debian_linux | 9.0 | — |
| fedoraproject fedora | 33, 34 | — |
| oracle communications_cloud_native_core_binding_support_function | 1.11.0 | — |
| oracle communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | — |
| oracle communications_cloud_native_core_network_repository_function | 1.15.0, 1.15.1 | — |
| oracle communications_cloud_native_core_network_slice_selection_function | 1.8.0 | — |
| oracle communications_cloud_native_core_service_communication_proxy | 1.15.0 | — |
| oracle essbase | v < 11.1.2.4.047, 21.0 ≤ v < 21.3 | 11.1.2.4.047, 21.3 |
| oracle mysql_server | v < 5.7.34, 8.0.15 ≤ v < 8.0.25 | 5.7.34, 8.0.25 |
| siemens sinec_infrastructure_network_services | v < 1.0.1.1 | 1.0.1.1 |
| splunk universal_forwarder | 8.2.0 ≤ v < 8.2.12, 9.0.0 ≤ v < 9.0.6, 9.1.0 | 8.2.12, 9.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.