// For flags

CVE-2021-22947

curl: Server responses received before STARTTLS processed after TLS handshake

Severity Score

5.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Cuando en curl versiones posteriores a 7.20.0 incluyéndola, y versiones anteriores a 7.78.0 incluyéndola, se conecta a un servidor IMAP o POP3 para recuperar datos usando STARTTLS para actualizar a la seguridad TLS, el servidor puede responder y enviar múltiples respuestas a la vez que curl almacena en caché. curl entonces actualizaría a TLS pero no vaciaría la cola de respuestas almacenadas en caché, sino que continuaría usando y confiando en las respuestas que obtuvo *antes* del protocolo de enlace TLS como si estuvieran autenticadas. Usando este fallo, permite a un atacante de tipo Man-In-The-Middle inyectar primero las respuestas falsas, luego pasar mediante el tráfico TLS del servidor legítimo y engañar a curl para que envíe datos de vuelta al usuario pensando que los datos inyectados por el atacante provienen del servidor protegido por TLS

A flaw was found in curl. The flaw lies in how curl handles cached or pipelined responses that it receives from either a IMAP, POP3, SMTP or FTP server before the TLS upgrade using STARTTLS. In such a scenario curl even after upgrading to TLS would trust these cached responses treating them as valid and authenticated and use them. An attacker could potentially use this flaw to carry out a Man-In-The-Middle attack. The highest threat from this vulnerability is to data confidentiality.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-01-06 CVE Reserved
  • 2021-09-15 CVE Published
  • 2024-05-05 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-310: Cryptographic Issues
  • CWE-319: Cleartext Transmission of Sensitive Information
  • CWE-345: Insufficient Verification of Data Authenticity
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Netapp
Search vendor "Netapp"
H300s Firmware
Search vendor "Netapp" for product "H300s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H300s
Search vendor "Netapp" for product "H300s"
--
Safe
Netapp
Search vendor "Netapp"
H500s Firmware
Search vendor "Netapp" for product "H500s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H500s
Search vendor "Netapp" for product "H500s"
--
Safe
Netapp
Search vendor "Netapp"
H700s Firmware
Search vendor "Netapp" for product "H700s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H700s
Search vendor "Netapp" for product "H700s"
--
Safe
Netapp
Search vendor "Netapp"
H300e Firmware
Search vendor "Netapp" for product "H300e Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H300e
Search vendor "Netapp" for product "H300e"
--
Safe
Netapp
Search vendor "Netapp"
H500e Firmware
Search vendor "Netapp" for product "H500e Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H500e
Search vendor "Netapp" for product "H500e"
--
Safe
Netapp
Search vendor "Netapp"
H700e Firmware
Search vendor "Netapp" for product "H700e Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H700e
Search vendor "Netapp" for product "H700e"
--
Safe
Netapp
Search vendor "Netapp"
H410s Firmware
Search vendor "Netapp" for product "H410s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H410s
Search vendor "Netapp" for product "H410s"
--
Safe
Netapp
Search vendor "Netapp"
Solidfire Baseboard Management Controller Firmware
Search vendor "Netapp" for product "Solidfire Baseboard Management Controller Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
Solidfire Baseboard Management Controller
Search vendor "Netapp" for product "Solidfire Baseboard Management Controller"
--
Safe
Haxx
Search vendor "Haxx"
Curl
Search vendor "Haxx" for product "Curl"
>= 7.20.0 < 7.79.0
Search vendor "Haxx" for product "Curl" and version " >= 7.20.0 < 7.79.0"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
33
Search vendor "Fedoraproject" for product "Fedora" and version "33"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
35
Search vendor "Fedoraproject" for product "Fedora" and version "35"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
9.0
Search vendor "Debian" for product "Debian Linux" and version "9.0"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
10.0
Search vendor "Debian" for product "Debian Linux" and version "10.0"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
11.0
Search vendor "Debian" for product "Debian Linux" and version "11.0"
-
Affected
Netapp
Search vendor "Netapp"
Cloud Backup
Search vendor "Netapp" for product "Cloud Backup"
--
Affected
Netapp
Search vendor "Netapp"
Clustered Data Ontap
Search vendor "Netapp" for product "Clustered Data Ontap"
--
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Binding Support Function
Search vendor "Oracle" for product "Communications Cloud Native Core Binding Support Function"
1.11.0
Search vendor "Oracle" for product "Communications Cloud Native Core Binding Support Function" and version "1.11.0"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Network Function Cloud Native Environment
Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment"
1.10.0
Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment" and version "1.10.0"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Network Repository Function
Search vendor "Oracle" for product "Communications Cloud Native Core Network Repository Function"
1.15.0
Search vendor "Oracle" for product "Communications Cloud Native Core Network Repository Function" and version "1.15.0"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Network Repository Function
Search vendor "Oracle" for product "Communications Cloud Native Core Network Repository Function"
1.15.1
Search vendor "Oracle" for product "Communications Cloud Native Core Network Repository Function" and version "1.15.1"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Network Slice Selection Function
Search vendor "Oracle" for product "Communications Cloud Native Core Network Slice Selection Function"
1.8.0
Search vendor "Oracle" for product "Communications Cloud Native Core Network Slice Selection Function" and version "1.8.0"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Service Communication Proxy
Search vendor "Oracle" for product "Communications Cloud Native Core Service Communication Proxy"
1.15.0
Search vendor "Oracle" for product "Communications Cloud Native Core Service Communication Proxy" and version "1.15.0"
-
Affected
Oracle
Search vendor "Oracle"
Mysql Server
Search vendor "Oracle" for product "Mysql Server"
>= 5.7.0 <= 5.7.35
Search vendor "Oracle" for product "Mysql Server" and version " >= 5.7.0 <= 5.7.35"
-
Affected
Oracle
Search vendor "Oracle"
Mysql Server
Search vendor "Oracle" for product "Mysql Server"
>= 8.0.0 <= 8.0.26
Search vendor "Oracle" for product "Mysql Server" and version " >= 8.0.0 <= 8.0.26"
-
Affected
Oracle
Search vendor "Oracle"
Peoplesoft Enterprise Peopletools
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools"
8.57
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.57"
-
Affected
Oracle
Search vendor "Oracle"
Peoplesoft Enterprise Peopletools
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools"
8.58
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.58"
-
Affected
Oracle
Search vendor "Oracle"
Peoplesoft Enterprise Peopletools
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools"
8.59
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.59"
-
Affected
Siemens
Search vendor "Siemens"
Sinec Infrastructure Network Services
Search vendor "Siemens" for product "Sinec Infrastructure Network Services"
< 1.0.1.1
Search vendor "Siemens" for product "Sinec Infrastructure Network Services" and version " < 1.0.1.1"
-
Affected
Apple
Search vendor "Apple"
Macos
Search vendor "Apple" for product "Macos"
< 12.3
Search vendor "Apple" for product "Macos" and version " < 12.3"
-
Affected
Oracle
Search vendor "Oracle"
Commerce Guided Search
Search vendor "Oracle" for product "Commerce Guided Search"
11.3.2
Search vendor "Oracle" for product "Commerce Guided Search" and version "11.3.2"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Binding Support Function
Search vendor "Oracle" for product "Communications Cloud Native Core Binding Support Function"
22.1.3
Search vendor "Oracle" for product "Communications Cloud Native Core Binding Support Function" and version "22.1.3"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Console
Search vendor "Oracle" for product "Communications Cloud Native Core Console"
22.2.0
Search vendor "Oracle" for product "Communications Cloud Native Core Console" and version "22.2.0"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Network Repository Function
Search vendor "Oracle" for product "Communications Cloud Native Core Network Repository Function"
22.1.2
Search vendor "Oracle" for product "Communications Cloud Native Core Network Repository Function" and version "22.1.2"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Network Repository Function
Search vendor "Oracle" for product "Communications Cloud Native Core Network Repository Function"
22.2.0
Search vendor "Oracle" for product "Communications Cloud Native Core Network Repository Function" and version "22.2.0"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Security Edge Protection Proxy
Search vendor "Oracle" for product "Communications Cloud Native Core Security Edge Protection Proxy"
22.1.1
Search vendor "Oracle" for product "Communications Cloud Native Core Security Edge Protection Proxy" and version "22.1.1"
-
Affected
Splunk
Search vendor "Splunk"
Universal Forwarder
Search vendor "Splunk" for product "Universal Forwarder"
>= 8.2.0 < 8.2.12
Search vendor "Splunk" for product "Universal Forwarder" and version " >= 8.2.0 < 8.2.12"
-
Affected
Splunk
Search vendor "Splunk"
Universal Forwarder
Search vendor "Splunk" for product "Universal Forwarder"
>= 9.0.0 < 9.0.6
Search vendor "Splunk" for product "Universal Forwarder" and version " >= 9.0.0 < 9.0.6"
-
Affected
Splunk
Search vendor "Splunk"
Universal Forwarder
Search vendor "Splunk" for product "Universal Forwarder"
9.1.0
Search vendor "Splunk" for product "Universal Forwarder" and version "9.1.0"
-
Affected