CVE-2021-22923
Medium
Description
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Haxx Curl
PublishedAug 5, 2021
First seenAug 5, 2021
Weakness typeCWE-319CWE-319
How to fix
Update
- haxx curl7.78.0 or later
- siemens sinec_infrastructure_network_services1.0.1.1 or later
- splunk universal_forwarder8.2.12, 9.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| haxx curl | 7.27.0 ≤ v < 7.78.0 | 7.78.0 |
| fedoraproject fedora | 33 | — |
| netapp cloud_backup | No range specified | — |
| netapp clustered_data_ontap | No range specified | — |
| netapp hci_management_node | No range specified | — |
| netapp solidfire | No range specified | — |
| oracle mysql_server | 5.7.0 ≤ v ≤ 5.7.35, 8.0.0 ≤ v ≤ 8.0.26 | — |
| siemens sinec_infrastructure_network_services | v < 1.0.1.1 | 1.0.1.1 |
| netapp h300s_firmware | No range specified | — |
| netapp h500s_firmware | No range specified | — |
| netapp h700s_firmware | No range specified | — |
| netapp h300e_firmware | No range specified | — |
| netapp h500e_firmware | No range specified | — |
| netapp h700e_firmware | No range specified | — |
| netapp h410s_firmware | No range specified | — |
| splunk universal_forwarder | 8.2.0 ≤ v < 8.2.12, 9.0.0 ≤ v < 9.0.6, 9.1.0 | 8.2.12, 9.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.