NetSight
IP …
low3.7

CVE-2021-22890

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tick…

Impact

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

Affected products

VendorProductAffected versions
HaxxLibcurl
from 7.63.0 through 7.75.0
FedoraprojectFedora
Versions 32, 33, 34
NetappHci Management Node
All versions
NetappSolidfire
All versions
NetappHci Storage Node
All versions
BroadcomFabric Operating System
All versions
DebianDebian Linux
Version 9.0
SiemensSinec Infrastructure Network Services
before 1.0.1.1
OracleCommunications Billing And Revenue Management
Version 12.0.0.3.0
OracleEssbase
Version 21.2
SplunkUniversal Forwarder
from 8.2.0 before 8.2.12
from 9.0.0 before 9.0.6
Version 9.1.0

Weakness classification

CWE-300CWE-290

References