CVE-2021-22897Proof of concept (PoC) published · CISASuited to automated attack · CISA

Vulnerability in N/a Https://github.com/curl/curl

CVSS score

5.3

EPSS probability

%4.3

Risk score

0.2

Published

5 y ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-22897 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-22897 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

ID	VENDOR	PRODUCT	ACTION
1	n/a	https://github.com/curl/curl	View
2	haxx	curl	View
3	oracle	communications cloud native core binding support function	View
4	oracle	communications cloud native core network function cloud native environment	View
5	oracle	communications cloud native core network repository function	View
6	oracle	communications cloud native core network repository function	View
7	oracle	communications cloud native core network slice selection function	View
8	oracle	communications cloud native core service communication proxy	View
9	oracle	essbase	View
10	oracle	essbase	View
11	oracle	mysql server	View
12	oracle	mysql server	View
13	netapp	cloud backup	View
14	netapp	solidfire, enterprise sds & hci storage node	View
15	netapp	solidfire & hci management node	View
16	netapp	solidfire baseboard management controller firmware	View
17	netapp	hci compute node firmware	View
18	netapp	hci compute node	View
19	netapp	h300e firmware	View
20	netapp	h300e	View
21	netapp	h300s firmware	View
22	netapp	h300s	View
23	netapp	h410s firmware	View
24	netapp	h410s	View
25	netapp	h500e firmware	View
26	netapp	h500e	View
27	netapp	h500s firmware	View
28	netapp	h500s	View
29	netapp	h700e firmware	View
30	netapp	h700e	View
31	netapp	h700s firmware	View
32	netapp	h700s	View
33	siemens	sinec infrastructure network services	View
34	splunk	universal forwarder	View
35	splunk	universal forwarder	View
36	splunk	universal forwarder	View

Total affected vendors: 6|Products: 36

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCORE	VERSION	SEVERITY	VECTOR	SOURCE
5.3	CVSS V31	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	NVD
5.3	CVSS V3_1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	CVE ADP
4.3	CVSS V2	—	AV:N/AC:M/Au:N/C:P/I:N/A:N	NVD

Patch and Remediation Guide