NetSight
IP …
high7.5

CVE-2021-22946

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command l…

Impact

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Affected products

VendorProductAffected versions
HaxxCurl
from 7.20.0 before 7.79.0
DebianDebian Linux
Versions 9.0, 10.0, 11.0
FedoraprojectFedora
Versions 33, 35
NetappCloud Backup
All versions
NetappClustered Data Ontap
All versions
NetappOncommand Insight
All versions
NetappOncommand Workflow Automation
All versions
NetappSnapcenter
All versions
NetappH300s Firmware
All versions
NetappH500s Firmware
All versions
NetappH700s Firmware
All versions
NetappH300e Firmware
All versions

Weakness classification

CWE-325CWE-319

References