Description
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.
Exploits (1)
nomisec
STUB
by Trinadh465 · poc
https://github.com/Trinadh465/external_curl_AOSP10_r33_CVE-2021-22924
References (15)
Scores
CVSS v3
3.7
EPSS
0.0075
EPSS Percentile
73.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-20
CWE-706
Status
published
Products (38)
debian/debian_linux
9.0
debian/debian_linux
10.0
debian/debian_linux
11.0
fedoraproject/fedora
33
haxx/libcurl
7.10.4 - 7.77.0
netapp/cloud_backup
netapp/clustered_data_ontap
netapp/solidfire_\&_hci_management_node
netapp/solidfire_baseboard_management_controller_firmware
oracle/mysql_server
5.7.0 - 5.7.36
... and 28 more
Published
Aug 05, 2021
Tracked Since
Feb 18, 2026