CVE-2021-22946

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://seclists.org/fulldisclosure/2022/Mar/29	Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf	Patch Third Party Advisory
https://hackerone.com/reports/1334111	Exploit Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202212-01	Third Party Advisory
https://security.netapp.com/advisory/ntap-20211029-0003/	Third Party Advisory
https://security.netapp.com/advisory/ntap-20220121-0008/	Third Party Advisory
https://support.apple.com/kb/HT213183	Release Notes Third Party Advisory
https://www.debian.org/security/2022/dsa-5197	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html	Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:9.0:::::::*
	cpe:2.3:o:debian:debian_linux:10.0:::::::*
	cpe:2.3:o:debian:debian_linux:11.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:33:::::::*
	cpe:2.3:o:fedoraproject:fedora:35:::::::*

Configuration 4 (hide)

OR	cpe:2.3:a:netapp:cloud_backup:-:::::::*
	cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*
	cpe:2.3:a:netapp:oncommand_insight:-:::::::*
	cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*
	cpe:2.3:a:netapp:snapcenter:-:::::::*

Configuration 5 (hide)

AND

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND

cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND

cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND

cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND

cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*

Configuration 13 (hide)

OR	cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:::::::*
	cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:::::::*
	cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:::::::*
	cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:::::::*
	cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:::::::*
	cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:::::::*
	cpe:2.3:a:oracle:mysql_server::::::::
	cpe:2.3:a:oracle:mysql_server::::::::
	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:::::::*
	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:::::::*
	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:::::::*

Configuration 14 (hide)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Configuration 15 (hide)

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Configuration 16 (hide)

OR	cpe:2.3:a:oracle:commerce_guided_search:11.3.2:::::::*
	cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:::::::*
	cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:::::::*
	cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:::::::*
	cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:::::::*
	cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:::::::*

Configuration 17 (hide)

OR	cpe:2.3:a:splunk:universal_forwarder::::::::
	cpe:2.3:a:splunk:universal_forwarder::::::::
	cpe:2.3:a:splunk:universal_forwarder:9.1.0:::::::*

History

27 Mar 2024, 15:12

Type	Values Removed	Values Added
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/ - Mailing List, Third Party Advisory
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/ - Mailing List, Third Party Advisory
CPE		cpe:2.3:a:splunk:universal_forwarder:9.1.0:::::::* cpe:2.3:a:splunk:universal_forwarder::::::::
First Time		Splunk universal Forwarder Splunk

19 Dec 2022, 04:15

Type	Values Removed	Values Added
References		(GENTOO) https://security.gentoo.org/glsa/202212-01 - (MLIST) https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html - Mailing List, Third Party Advisory
References	~~(N/A) https://www.oracle.com/security-alerts/cpujul2022.html -~~	(N/A) https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory
References	~~(DEBIAN) https://www.debian.org/security/2022/dsa-5197 -~~	(DEBIAN) https://www.debian.org/security/2022/dsa-5197 - Third Party Advisory
CPE		cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:::::::* cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:::::::* cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:::::::* cpe:2.3:a:oracle:commerce_guided_search:11.3.2:::::::* cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:::::::* cpe:2.3:o:debian:debian_linux:11.0:::::::* cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:::::::* cpe:2.3:o:debian:debian_linux:10.0:::::::*

02 Aug 2022, 03:15

Type	Values Removed	Values Added
References		(DEBIAN) https://www.debian.org/security/2022/dsa-5197 -

25 Jul 2022, 18:15

Type	Values Removed	Values Added
References		(N/A) https://www.oracle.com/security-alerts/cpujul2022.html -

13 May 2022, 17:20

Type	Values Removed	Values Added
References	~~(FULLDISC) http://seclists.org/fulldisclosure/2022/Mar/29 -~~	(FULLDISC) http://seclists.org/fulldisclosure/2022/Mar/29 - Mailing List, Third Party Advisory
References	~~(CONFIRM) https://support.apple.com/kb/HT213183 -~~	(CONFIRM) https://support.apple.com/kb/HT213183 - Release Notes, Third Party Advisory
References	~~(CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf -~~	(CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - Patch, Third Party Advisory
References	~~(MISC) https://www.oracle.com/security-alerts/cpuapr2022.html -~~	(MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory
CPE		cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:::::::* cpe:2.3:o:apple:macos:::::::: cpe:2.3:a:siemens:sinec_infrastructure_network_services:::::::: cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:::::::* cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:::::::* cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:::::::* cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:::::::* cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:::::::*

20 Apr 2022, 00:15

Type	Values Removed	Values Added
References		(MISC) https://www.oracle.com/security-alerts/cpuapr2022.html -

15 Mar 2022, 06:15

Type	Values Removed	Values Added
References		(FULLDISC) http://seclists.org/fulldisclosure/2022/Mar/29 -

14 Mar 2022, 19:15

Type	Values Removed	Values Added
References		(CONFIRM) https://support.apple.com/kb/HT213183 -

10 Mar 2022, 17:41

Type	Values Removed	Values Added
References		(CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf -

11 Feb 2022, 15:26

Type	Values Removed	Values Added
CPE		cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:::::::* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:::::::* cpe:2.3:a:netapp:oncommand_insight:-:::::::* cpe:2.3:a:netapp:snapcenter:-:::::::* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:::::::* cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::* cpe:2.3:a:netapp:cloud_backup:-:::::::*
References	~~(MISC) https://www.oracle.com/security-alerts/cpujan2022.html -~~	(MISC) https://www.oracle.com/security-alerts/cpujan2022.html - Third Party Advisory
References	~~(CONFIRM) https://security.netapp.com/advisory/ntap-20220121-0008/ -~~	(CONFIRM) https://security.netapp.com/advisory/ntap-20220121-0008/ - Third Party Advisory
References	~~(MISC) https://hackerone.com/reports/1334111 - Exploit, Issue Tracking, Third Party Advisory~~	(MISC) https://hackerone.com/reports/1334111 - Exploit, Issue Tracking, Patch, Third Party Advisory

07 Feb 2022, 16:15

Type	Values Removed	Values Added
References		(MISC) https://www.oracle.com/security-alerts/cpujan2022.html -

21 Jan 2022, 12:15

Type	Values Removed	Values Added
References		(CONFIRM) https://security.netapp.com/advisory/ntap-20220121-0008/ -

28 Nov 2021, 23:12

Type	Values Removed	Values Added
CPE		cpe:2.3:o:netapp:h500s_firmware:-:::::::* cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:::::::* cpe:2.3:o:netapp:h300e_firmware:-:::::::* cpe:2.3:h:netapp:h700s:-:::::::* cpe:2.3:o:fedoraproject:fedora:35:::::::* cpe:2.3:o:netapp:h700e_firmware:-:::::::* cpe:2.3:h:netapp:h410s:-:::::::* cpe:2.3:h:netapp:h500s:-:::::::* cpe:2.3:o:netapp:h500e_firmware:-:::::::* cpe:2.3:a:oracle:mysql_server:::::::: cpe:2.3:h:netapp:h300s:-:::::::* cpe:2.3:a:netapp:clustered_data_ontap:-:::::::* cpe:2.3:o:netapp:h700s_firmware:-:::::::* cpe:2.3:h:netapp:h300e:-:::::::* cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:::::::* cpe:2.3:h:netapp:h500e:-:::::::* cpe:2.3:h:netapp:h700e:-:::::::* cpe:2.3:o:netapp:h300s_firmware:-:::::::* cpe:2.3:o:netapp:h410s_firmware:-:::::::*
References	~~(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/ -~~	(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/ - Mailing List, Third Party Advisory
References	~~(MISC) https://www.oracle.com/security-alerts/cpuoct2021.html -~~	(MISC) https://www.oracle.com/security-alerts/cpuoct2021.html - Patch, Third Party Advisory
References	~~(CONFIRM) https://security.netapp.com/advisory/ntap-20211029-0003/ -~~	(CONFIRM) https://security.netapp.com/advisory/ntap-20211029-0003/ - Third Party Advisory

17 Nov 2021, 22:17

Type	Values Removed	Values Added
References		(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/ -

10 Nov 2021, 01:16

Type	Values Removed	Values Added
References	{'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/', 'name': 'FEDORA-2021-1d24845e93', 'tags': [], 'refsource': 'FEDORA'}

03 Nov 2021, 04:15

Type	Values Removed	Values Added
References		(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/ -

29 Oct 2021, 13:15

Type	Values Removed	Values Added
References		(CONFIRM) https://security.netapp.com/advisory/ntap-20211029-0003/ -

20 Oct 2021, 11:16

Type	Values Removed	Values Added
References		(MISC) https://www.oracle.com/security-alerts/cpuoct2021.html -

08 Oct 2021, 02:21

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 5.0 v3 : 7.5
CWE		CWE-319
CPE		cpe:2.3:o:fedoraproject:fedora:33:::::::* cpe:2.3:a:haxx:curl:::::::: cpe:2.3:o:debian:debian_linux:9.0:::::::*
References	~~(MISC) https://hackerone.com/reports/1334111 -~~	(MISC) https://hackerone.com/reports/1334111 - Exploit, Issue Tracking, Third Party Advisory
References	~~(MLIST) https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html -~~	(MLIST) https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html - Mailing List, Third Party Advisory
References	~~(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/ -~~	(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/ - Mailing List, Third Party Advisory

02 Oct 2021, 03:15

Type	Values Removed	Values Added
References		(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/ -

01 Oct 2021, 01:15

Type	Values Removed	Values Added
References		(MLIST) https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html -

29 Sep 2021, 20:55

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-09-29 20:15

Updated : 2024-03-27 15:12

NVD link : CVE-2021-22946

Mitre link : CVE-2021-22946

CVE.ORG link : CVE-2021-22946

JSON object : View

Products Affected

netapp

h300s_firmware
solidfire_baseboard_management_controller
h500e
h300s
h300e
oncommand_insight
h700e_firmware
h700e
h410s
h500s
h500s_firmware
snapcenter
h300e_firmware
clustered_data_ontap
h700s_firmware
h700s
h410s_firmware
solidfire_baseboard_management_controller_firmware
cloud_backup
oncommand_workflow_automation
h500e_firmware

oracle

communications_cloud_native_core_security_edge_protection_proxy
communications_cloud_native_core_network_repository_function
communications_cloud_native_core_network_function_cloud_native_environment
peoplesoft_enterprise_peopletools
commerce_guided_search
communications_cloud_native_core_service_communication_proxy
mysql_server
communications_cloud_native_core_console
communications_cloud_native_core_binding_support_function
communications_cloud_native_core_network_slice_selection_function

apple

macos

debian

debian_linux

haxx

curl

splunk

universal_forwarder

siemens

sinec_infrastructure_network_services

fedoraproject

fedora

CWE

CWE-319

Cleartext Transmission of Sensitive Information

CWE-325

Missing Cryptographic Step

7.5 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

JSON object

Attach tags to CVE-2021-22946

7.5^/10

5.0^/10

Attach tags to `CVE-2021-22946`