Vulnerability-Lookup

RHSA-2021:3582

Vulnerability from csaf_redhat - Published: 2021-09-21 12:25 - Updated: 2025-11-21 18:25

Summary

Red Hat Security Advisory: curl security update

Severity

Moderate

Notes

Topic: An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: Content not matching hash in Metalink is not being discarded (CVE-2021-22922) * curl: Metalink download sends credentials (CVE-2021-22923) * curl: Bad connection reuse due to flawed path name checks (CVE-2021-22924) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2021-22922

A flaw was found in curl in the way curl handles a file hash mismatch after downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to trick users into downloading malicious content. The highest threat from this vulnerability is to integrity.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-20 - Improper Input Validation

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2021:3582

Workaround This flaw can be mitigated by upgrading the affected curl utility to version 7.78.0 or by disabling the metalink feature in your current build

CVE-2021-22923

A flaw was found in curl in the way curl handles credentials when downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to gain access to credentials provided while downloading content without the user's knowledge. The highest threat from this vulnerability is to confidentiality.

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE-522 - Insufficiently Protected Credentials

Workaround This flaw can be mitigated by upgrading the affected curl utility to version 7.78.0 or by disabling the metalink feature in your current build

CVE-2021-22924

A flaw was found in libcurl in the way libcurl handles previously used connections without accounting for 'issuer cert' and comparing the involved paths case-insensitively. This flaw allows libcurl to use the wrong connection. The highest threat from this vulnerability is to confidentiality.

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-295 - Improper Certificate Validation

Workaround This flaw can be mitigated by upgrading the affected curl utility to version 7.78.0

References

URL

Category

	https://access.redhat.com/errata/RHSA-2021:3582	self
	https://access.redhat.com/security/updates/classi…	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1981435	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1981438	external
	https://bugzilla.redhat.com/show_bug.cgi?id=1981460	external
	https://security.access.redhat.com/data/csaf/v2/a…	self
	https://access.redhat.com/security/cve/CVE-2021-22922	self
	https://bugzilla.redhat.com/show_bug.cgi?id=1981435	external
	https://www.cve.org/CVERecord?id=CVE-2021-22922	external
	https://nvd.nist.gov/vuln/detail/CVE-2021-22922	external
	https://curl.se/docs/CVE-2021-22922.html	external
	https://access.redhat.com/security/cve/CVE-2021-22923	self
	https://bugzilla.redhat.com/show_bug.cgi?id=1981438	external
	https://www.cve.org/CVERecord?id=CVE-2021-22923	external
	https://nvd.nist.gov/vuln/detail/CVE-2021-22923	external
	https://curl.se/docs/CVE-2021-22923.html	external
	https://access.redhat.com/security/cve/CVE-2021-22924	self
	https://bugzilla.redhat.com/show_bug.cgi?id=1981460	external
	https://www.cve.org/CVERecord?id=CVE-2021-22924	external
	https://nvd.nist.gov/vuln/detail/CVE-2021-22924	external
	https://curl.se/docs/CVE-2021-22924.html	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for curl is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: Content not matching hash in Metalink is not being discarded (CVE-2021-22922)\n\n* curl: Metalink download sends credentials (CVE-2021-22923)\n\n* curl: Bad connection reuse due to flawed path name checks (CVE-2021-22924)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:3582",
        "url": "https://access.redhat.com/errata/RHSA-2021:3582"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1981435",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981435"
      },
      {
        "category": "external",
        "summary": "1981438",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981438"
      },
      {
        "category": "external",
        "summary": "1981460",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981460"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3582.json"
      }
    ],
    "title": "Red Hat Security Advisory: curl security update",
    "tracking": {
      "current_release_date": "2025-11-21T18:25:17+00:00",
      "generator": {
        "date": "2025-11-21T18:25:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2021:3582",
      "initial_release_date": "2021-09-21T12:25:55+00:00",
      "revision_history": [
        {
          "date": "2021-09-21T12:25:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-09-21T12:25:55+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T18:25:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                  "product_id": "BaseOS-8.4.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-18.el8_4.1.src",
                "product": {
                  "name": "curl-0:7.61.1-18.el8_4.1.src",
                  "product_id": "curl-0:7.61.1-18.el8_4.1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.61.1-18.el8_4.1?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-18.el8_4.1.aarch64",
                "product": {
                  "name": "curl-0:7.61.1-18.el8_4.1.aarch64",
                  "product_id": "curl-0:7.61.1-18.el8_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.61.1-18.el8_4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-18.el8_4.1.aarch64",
                "product": {
                  "name": "libcurl-0:7.61.1-18.el8_4.1.aarch64",
                  "product_id": "libcurl-0:7.61.1-18.el8_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.61.1-18.el8_4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
                  "product_id": "libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.61.1-18.el8_4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
                  "product_id": "libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@7.61.1-18.el8_4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
                "product": {
                  "name": "curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
                  "product_id": "curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@7.61.1-18.el8_4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                "product": {
                  "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                  "product_id": "curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@7.61.1-18.el8_4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                "product": {
                  "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                  "product_id": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-minimal-debuginfo@7.61.1-18.el8_4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                "product": {
                  "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                  "product_id": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@7.61.1-18.el8_4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                  "product_id": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@7.61.1-18.el8_4.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-18.el8_4.1.ppc64le",
                "product": {
                  "name": "curl-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_id": "curl-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.61.1-18.el8_4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-18.el8_4.1.ppc64le",
                "product": {
                  "name": "libcurl-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_id": "libcurl-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.61.1-18.el8_4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_id": "libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.61.1-18.el8_4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_id": "libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@7.61.1-18.el8_4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
                "product": {
                  "name": "curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_id": "curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@7.61.1-18.el8_4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                "product": {
                  "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_id": "curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@7.61.1-18.el8_4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                "product": {
                  "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_id": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-minimal-debuginfo@7.61.1-18.el8_4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                "product": {
                  "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_id": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@7.61.1-18.el8_4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_id": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@7.61.1-18.el8_4.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-18.el8_4.1.x86_64",
                "product": {
                  "name": "curl-0:7.61.1-18.el8_4.1.x86_64",
                  "product_id": "curl-0:7.61.1-18.el8_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.61.1-18.el8_4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-18.el8_4.1.x86_64",
                "product": {
                  "name": "libcurl-0:7.61.1-18.el8_4.1.x86_64",
                  "product_id": "libcurl-0:7.61.1-18.el8_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.61.1-18.el8_4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
                  "product_id": "libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.61.1-18.el8_4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
                  "product_id": "libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@7.61.1-18.el8_4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
                "product": {
                  "name": "curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
                  "product_id": "curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@7.61.1-18.el8_4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                "product": {
                  "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                  "product_id": "curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@7.61.1-18.el8_4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                "product": {
                  "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                  "product_id": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-minimal-debuginfo@7.61.1-18.el8_4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                "product": {
                  "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                  "product_id": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@7.61.1-18.el8_4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                  "product_id": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@7.61.1-18.el8_4.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-18.el8_4.1.i686",
                "product": {
                  "name": "libcurl-0:7.61.1-18.el8_4.1.i686",
                  "product_id": "libcurl-0:7.61.1-18.el8_4.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.61.1-18.el8_4.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-18.el8_4.1.i686",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-18.el8_4.1.i686",
                  "product_id": "libcurl-devel-0:7.61.1-18.el8_4.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.61.1-18.el8_4.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
                  "product_id": "libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@7.61.1-18.el8_4.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:7.61.1-18.el8_4.1.i686",
                "product": {
                  "name": "curl-debugsource-0:7.61.1-18.el8_4.1.i686",
                  "product_id": "curl-debugsource-0:7.61.1-18.el8_4.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@7.61.1-18.el8_4.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
                "product": {
                  "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
                  "product_id": "curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@7.61.1-18.el8_4.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
                "product": {
                  "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
                  "product_id": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-minimal-debuginfo@7.61.1-18.el8_4.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
                "product": {
                  "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
                  "product_id": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@7.61.1-18.el8_4.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
                  "product_id": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@7.61.1-18.el8_4.1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-18.el8_4.1.s390x",
                "product": {
                  "name": "curl-0:7.61.1-18.el8_4.1.s390x",
                  "product_id": "curl-0:7.61.1-18.el8_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.61.1-18.el8_4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-18.el8_4.1.s390x",
                "product": {
                  "name": "libcurl-0:7.61.1-18.el8_4.1.s390x",
                  "product_id": "libcurl-0:7.61.1-18.el8_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.61.1-18.el8_4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
                  "product_id": "libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.61.1-18.el8_4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
                  "product_id": "libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@7.61.1-18.el8_4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
                "product": {
                  "name": "curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
                  "product_id": "curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@7.61.1-18.el8_4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                "product": {
                  "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                  "product_id": "curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@7.61.1-18.el8_4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                "product": {
                  "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                  "product_id": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-minimal-debuginfo@7.61.1-18.el8_4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                "product": {
                  "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                  "product_id": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@7.61.1-18.el8_4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                  "product_id": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@7.61.1-18.el8_4.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-18.el8_4.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64"
        },
        "product_reference": "curl-0:7.61.1-18.el8_4.1.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-18.el8_4.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le"
        },
        "product_reference": "curl-0:7.61.1-18.el8_4.1.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-18.el8_4.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x"
        },
        "product_reference": "curl-0:7.61.1-18.el8_4.1.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-18.el8_4.1.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src"
        },
        "product_reference": "curl-0:7.61.1-18.el8_4.1.src",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-18.el8_4.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64"
        },
        "product_reference": "curl-0:7.61.1-18.el8_4.1.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64"
        },
        "product_reference": "curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686"
        },
        "product_reference": "curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le"
        },
        "product_reference": "curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x"
        },
        "product_reference": "curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
        },
        "product_reference": "curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:7.61.1-18.el8_4.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64"
        },
        "product_reference": "curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:7.61.1-18.el8_4.1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686"
        },
        "product_reference": "curl-debugsource-0:7.61.1-18.el8_4.1.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le"
        },
        "product_reference": "curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:7.61.1-18.el8_4.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x"
        },
        "product_reference": "curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:7.61.1-18.el8_4.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64"
        },
        "product_reference": "curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64"
        },
        "product_reference": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686"
        },
        "product_reference": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le"
        },
        "product_reference": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x"
        },
        "product_reference": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
        },
        "product_reference": "curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-18.el8_4.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64"
        },
        "product_reference": "libcurl-0:7.61.1-18.el8_4.1.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-18.el8_4.1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686"
        },
        "product_reference": "libcurl-0:7.61.1-18.el8_4.1.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-18.el8_4.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le"
        },
        "product_reference": "libcurl-0:7.61.1-18.el8_4.1.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-18.el8_4.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x"
        },
        "product_reference": "libcurl-0:7.61.1-18.el8_4.1.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-18.el8_4.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64"
        },
        "product_reference": "libcurl-0:7.61.1-18.el8_4.1.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64"
        },
        "product_reference": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686"
        },
        "product_reference": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le"
        },
        "product_reference": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x"
        },
        "product_reference": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
        },
        "product_reference": "libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-18.el8_4.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64"
        },
        "product_reference": "libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-18.el8_4.1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686"
        },
        "product_reference": "libcurl-devel-0:7.61.1-18.el8_4.1.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le"
        },
        "product_reference": "libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-18.el8_4.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x"
        },
        "product_reference": "libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-18.el8_4.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64"
        },
        "product_reference": "libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-22922",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-07-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1981435"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl in the way curl handles a file hash mismatch after downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to trick users into downloading malicious content. The highest threat from this vulnerability is to integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: Content not matching hash in Metalink is not being discarded",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-22922"
        },
        {
          "category": "external",
          "summary": "RHBZ#1981435",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981435"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22922",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-22922"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22922",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22922"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2021-22922.html",
          "url": "https://curl.se/docs/CVE-2021-22922.html"
        }
      ],
      "release_date": "2021-07-21T06:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-09-21T12:25:55+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3582"
        },
        {
          "category": "workaround",
          "details": "This flaw can be mitigated by upgrading the affected curl utility to version 7.78.0 or by disabling the metalink feature in your current build",
          "product_ids": [
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: Content not matching hash in Metalink is not being discarded"
    },
    {
      "cve": "CVE-2021-22923",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2021-07-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1981438"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl in the way curl handles credentials when downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to gain access to credentials provided while downloading content without the user\u0027s knowledge. The highest threat from this vulnerability is to confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: Metalink download sends credentials",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-22923"
        },
        {
          "category": "external",
          "summary": "RHBZ#1981438",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981438"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22923",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-22923"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22923",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22923"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2021-22923.html",
          "url": "https://curl.se/docs/CVE-2021-22923.html"
        }
      ],
      "release_date": "2021-07-21T06:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-09-21T12:25:55+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3582"
        },
        {
          "category": "workaround",
          "details": "This flaw can be mitigated by upgrading the affected curl utility to version 7.78.0 or by disabling the metalink feature in your current build",
          "product_ids": [
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: Metalink download sends credentials"
    },
    {
      "cve": "CVE-2021-22924",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2021-07-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1981460"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl in the way libcurl handles previously used connections without accounting for \u0027issuer cert\u0027 and comparing the involved paths case-insensitively. This flaw allows libcurl to use the wrong connection. The highest threat from this vulnerability is to confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: Bad connection reuse due to flawed path name checks",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
          "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-22924"
        },
        {
          "category": "external",
          "summary": "RHBZ#1981460",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981460"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22924",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-22924"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22924",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22924"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2021-22924.html",
          "url": "https://curl.se/docs/CVE-2021-22924.html"
        }
      ],
      "release_date": "2021-07-21T06:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-09-21T12:25:55+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3582"
        },
        {
          "category": "workaround",
          "details": "This flaw can be mitigated by upgrading the affected curl utility to version 7.78.0",
          "product_ids": [
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.src",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-18.el8_4.1.x86_64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.aarch64",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.i686",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.ppc64le",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.s390x",
            "BaseOS-8.4.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-18.el8_4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: Bad connection reuse due to flawed path name checks"
    }
  ]
}

CVE-2021-22922 (GCVE-0-2021-22922)

Vulnerability from cvelistv5 – Published: 2021-08-05 00:00 – Updated: 2024-08-03 18:58

Summary

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

Severity ?

No CVSS data available.

CWE

CWE-840 - Business Logic Errors (CWE-840)

Assigner

hackerone

References

URL

Tags

	https://hackerone.com/reports/1213175
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
	https://lists.apache.org/thread.html/r61db8e7dcb5…	mailing-list
	https://lists.apache.org/thread.html/r61db8e7dcb5…	mailing-list
	https://lists.apache.org/thread.html/rbf4ce74b0d1…	mailing-list
	https://lists.apache.org/thread.html/rbf4ce74b0d1…	mailing-list
	https://www.oracle.com/security-alerts/cpuoct2021.html
	https://security.netapp.com/advisory/ntap-2021090…
	https://cert-portal.siemens.com/productcert/pdf/s…
	https://security.gentoo.org/glsa/202212-01	vendor-advisory

Impacted products

	Vendor	Product	Version
	n/a	https://github.com/curl/curl	Affected: curl 7.27.0 to and including 7.77.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:58:26.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1213175"
          },
          {
            "name": "FEDORA-2021-5d21b90a30",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/"
          },
          {
            "name": "[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210902-0003/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
          },
          {
            "name": "GLSA-202212-01",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202212-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/curl/curl",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "curl 7.27.0  to and including 7.77.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-840",
              "description": "Business Logic Errors (CWE-840)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-19T00:00:00.000Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/1213175"
        },
        {
          "name": "FEDORA-2021-5d21b90a30",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/"
        },
        {
          "name": "[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210902-0003/"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        },
        {
          "name": "GLSA-202212-01",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202212-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2021-22922",
    "datePublished": "2021-08-05T00:00:00.000Z",
    "dateReserved": "2021-01-06T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:58:26.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22924 (GCVE-0-2021-22924)

Vulnerability from cvelistv5 – Published: 2021-08-05 20:16 – Updated: 2025-06-09 15:02

Summary

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Severity ?

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-20 - Improper Input Validation (CWE-20)

Assigner

hackerone

References

URL

Tags

	https://hackerone.com/reports/1223565	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r61db8e7dcb5…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/r61db8e7dcb5…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rbf4ce74b0d1…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/rbf4ce74b0d1…	mailing-listx_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-2021090…	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
	https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
	https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
	https://www.debian.org/security/2022/dsa-5197	vendor-advisoryx_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022…	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	https://github.com/curl/curl	Affected: curl 7.10.4 to and include curl 7.77.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:58:25.955Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1223565"
          },
          {
            "name": "FEDORA-2021-5d21b90a30",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/"
          },
          {
            "name": "[debian-lts-announce] 20210813 [SECURITY] [DLA 2734-1] curl security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html"
          },
          {
            "name": "[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210902-0003/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf"
          },
          {
            "name": "DSA-5197",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5197"
          },
          {
            "name": "[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-22924",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-27T19:35:55.513610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-09T15:02:19.721Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/curl/curl",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "curl 7.10.4 to and include curl 7.77.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take \u0027issuercert\u0027 into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn\u0027t include the \u0027issuer cert\u0027 which a transfer can setto qualify how to verify the server certificate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation (CWE-20)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-29T00:06:17.000Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1223565"
        },
        {
          "name": "FEDORA-2021-5d21b90a30",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/"
        },
        {
          "name": "[debian-lts-announce] 20210813 [SECURITY] [DLA 2734-1] curl security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html"
        },
        {
          "name": "[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210902-0003/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf"
        },
        {
          "name": "DSA-5197",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5197"
        },
        {
          "name": "[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2021-22924",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "https://github.com/curl/curl",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "curl 7.10.4 to and include curl 7.77.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take \u0027issuercert\u0027 into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn\u0027t include the \u0027issuer cert\u0027 which a transfer can setto qualify how to verify the server certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Input Validation (CWE-20)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/1223565",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/1223565"
            },
            {
              "name": "FEDORA-2021-5d21b90a30",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/"
            },
            {
              "name": "[debian-lts-announce] 20210813 [SECURITY] [DLA 2734-1] curl security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html"
            },
            {
              "name": "[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210902-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210902-0003/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf"
            },
            {
              "name": "DSA-5197",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5197"
            },
            {
              "name": "[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2021-22924",
    "datePublished": "2021-08-05T20:16:56.000Z",
    "dateReserved": "2021-01-06T00:00:00.000Z",
    "dateUpdated": "2025-06-09T15:02:19.721Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-22923 (GCVE-0-2021-22923)

Vulnerability from cvelistv5 – Published: 2021-08-05 00:00 – Updated: 2024-11-19 14:25

Summary

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

Severity ?

No CVSS data available.

CWE

CWE-319 - Cleartext Transmission of Sensitive Information (CWE-319)

Assigner

hackerone

References

URL

Tags

	https://hackerone.com/reports/1213181
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
	https://www.oracle.com/security-alerts/cpuoct2021.html
	https://security.netapp.com/advisory/ntap-2021090…
	https://cert-portal.siemens.com/productcert/pdf/s…
	https://security.gentoo.org/glsa/202212-01	vendor-advisory

Impacted products

	Vendor	Product	Version
	n/a	https://github.com/curl/curl	Affected: curl 7.27.0 to and including 7.77.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:58:26.153Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1213181"
          },
          {
            "name": "FEDORA-2021-5d21b90a30",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210902-0003/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
          },
          {
            "name": "GLSA-202212-01",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202212-01"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-22923",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-19T14:25:07.338932Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-19T14:25:24.567Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/curl/curl",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "curl 7.27.0 to and including 7.77.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user\u0027s expectations and intentions and without telling the user it happened."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "Cleartext Transmission of Sensitive Information (CWE-319)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-19T00:00:00.000Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/1213181"
        },
        {
          "name": "FEDORA-2021-5d21b90a30",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210902-0003/"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        },
        {
          "name": "GLSA-202212-01",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202212-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2021-22923",
    "datePublished": "2021-08-05T00:00:00.000Z",
    "dateReserved": "2021-01-06T00:00:00.000Z",
    "dateUpdated": "2024-11-19T14:25:24.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2021:3582

CVE-2021-22922 (GCVE-0-2021-22922)

CVE-2021-22924 (GCVE-0-2021-22924)

CVE-2021-22923 (GCVE-0-2021-22923)

Tags

Sightings

Nomenclature