NetSight
IP …
low3.7

CVE-2021-22924

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, t…

Impact

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Affected products

VendorProductAffected versions
HaxxLibcurl
from 7.10.4 before 7.77.0
FedoraprojectFedora
Version 33
DebianDebian Linux
Versions 9.0, 10.0, 11.0
NetappCloud Backup
All versions
NetappClustered Data Ontap
All versions
NetappSolidfire \& Hci Management Node
All versions
NetappSolidfire Baseboard Management Controller Firmware
All versions
OracleMysql Server
from 5.7.0 through 5.7.36
from 8.0.0 through 8.0.26
OraclePeoplesoft Enterprise Peopletools
Versions 8.57, 8.58, 8.59
SiemensSinec Infrastructure Network Services
before 1.0.1.1
SiemensSinema Remote Connect Server
before 3.1
SiemensLogo\! Cmr2040 Firmware
All versions

Weakness classification

CWE-20CWE-706

References