CVE-2021-22924

moderate-risk
Published 2021-08-05

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Do I need to act?

-
0.75% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10 Low
NETWORK / HIGH complexity

Affected Products (20)

Logo\! Cmr2040 Firmware
Logo\! Cmr2020 Firmware
Ruggedcomrm 1224 Lte Firmware
Scalance M804Pb Firmware
Scalance M812-1 Firmware

Affected Vendors

Debian Oracle Siemens Haxx Fedoraproject Netapp Splunk

References (30)

Patch https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf
Exploit https://hackerone.com/reports/1223565
Mailing List https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b...
Mailing List https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b...
Mailing List https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c2...
Mailing List https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c2...
Mailing List https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html
Mailing List https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.netapp.com/advisory/ntap-20210902-0003/
Third Party Advisory https://www.debian.org/security/2022/dsa-5197
Patch https://www.oracle.com/security-alerts/cpujan2022.html
Patch https://www.oracle.com/security-alerts/cpuoct2021.html
Patch https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf
Exploit https://hackerone.com/reports/1223565
Mailing List https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b...
and 10 more references
40
/ 100
moderate-risk
Severity 13/34 · Low
Exploitability 3/34 · Minimal
Exposure 24/34 · High