medium5.3
CVE-2021-22923
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credenti…
Impact
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Haxx | Curl | from 7.27.0 before 7.78.0 |
| Fedoraproject | Fedora | Version 33 |
| Netapp | Cloud Backup | All versions |
| Netapp | Clustered Data Ontap | All versions |
| Netapp | Hci Management Node | All versions |
| Netapp | Solidfire | All versions |
| Oracle | Mysql Server | from 5.7.0 through 5.7.35 from 8.0.0 through 8.0.26 |
| Siemens | Sinec Infrastructure Network Services | before 1.0.1.1 |
| Netapp | H300s Firmware | All versions |
| Netapp | H500s Firmware | All versions |
| Netapp | H700s Firmware | All versions |
| Netapp | H300e Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1213181
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20210902-0003/
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html