1. CVE-Search
  2. CVE-2021-22897
ID CVE-2021-22897
Summary curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
References
Vulnerable Configurations
  • cpe:2.3:a:haxx:curl:7.61.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.61.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.61.1:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.61.1:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.62.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.62.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.63.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.63.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.64.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.64.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.64.1:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.64.1:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.65.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.65.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.65.1:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.65.1:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.65.2:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.65.2:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.65.3:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.65.3:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.66.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.66.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.67.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.67.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.68.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.68.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.69.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.69.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.69.1:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.69.1:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.70.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.70.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.71.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.71.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.71.1:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.71.1:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.72.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.72.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.73.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.73.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.74.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.74.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.75.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.75.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.76.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.76.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.76.1:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.76.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql_server:8.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql_server:8.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql_server:8.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql_server:8.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql_server:8.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql_server:8.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql_server:8.0.22:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql_server:8.0.22:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql_server:8.0.23:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql_server:8.0.23:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql_server:8.0.24:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql_server:8.0.24:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql_server:8.0.25:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql_server:8.0.25:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:essbase:21.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:essbase:21.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql_server:5.7.27:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mysql_server:5.7.27:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
    cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
    cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
    cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:sinec_infrastructure_network_services:-:*:*:*:*:*:*:*
    cpe:2.3:a:siemens:sinec_infrastructure_network_services:-:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:sinec_infrastructure_network_services:1.0.1:-:*:*:*:*:*:*
    cpe:2.3:a:siemens:sinec_infrastructure_network_services:1.0.1:-:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.10:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.11:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.11:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 27-03-2024 - 15:47)
Impact:
Exploitability:
CWE CWE-668
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:N/A:N
Last major update 27-03-2024 - 15:47
Published 11-06-2021 - 16:15
Last modified 27-03-2024 - 15:47
Back to Top