CVE-2021-38165

MEDIUM

Lynx < 2.8.9 - Credential Exposure via URI Userinfo in SNI Data

Title source: llm
STIX 2.1

Description

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

References (13)

Core 13
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugs.debian.org/991971
Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2021/08/07/1
Release Notes, Third Party Advisory x_refsource_misc
https://lynx.invisible-island.net/current/CHANGES.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/08/07/9
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/08/07/12
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/08/07/11
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/08/msg00010.html
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4953

Scores

CVSS v3 5.3
EPSS 0.0428
EPSS Percentile 89.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-522
Status published
Products (6)
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 33
fedoraproject/fedora 34
fedoraproject/fedora 35
lynx_project/lynx < 2.8.9
Published Aug 07, 2021
Tracked Since Feb 18, 2026