NetSight
IP …
low3.1

CVE-2021-22898

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send …

Impact

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

Affected products

VendorProductAffected versions
HaxxCurl
from 7.7 through 7.76.1
DebianDebian Linux
Version 9.0
FedoraprojectFedora
Versions 33, 34
OracleCommunications Cloud Native Core Binding Support Function
Version 1.11.0
OracleCommunications Cloud Native Core Network Function Cloud Native Environment
Version 1.10.0
OracleCommunications Cloud Native Core Network Repository Function
Versions 1.15.0, 1.15.1
OracleCommunications Cloud Native Core Network Slice Selection Function
Version 1.8.0
OracleCommunications Cloud Native Core Service Communication Proxy
Version 1.15.0
OracleEssbase
before 11.1.2.4.047
from 21.0 before 21.3
OracleMysql Server
before 5.7.34
from 8.0.15 before 8.0.25
SiemensSinec Infrastructure Network Services
before 1.0.1.1
SplunkUniversal Forwarder
from 8.2.0 before 8.2.12
from 9.0.0 before 9.0.6
Version 9.1.0

Weakness classification

CWE-200CWE-909

References