CVE-2021-22876 Information disclosure in https://github.com/curl/curl
Attackers can steal credentials leaked in HTTP Referer headers when curl redirects requests, exposing sensitive user data to unauthorized servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22876?
CVE-2021-22876 is a medium-severity vulnerability in Broadcom Fabric Operating System, published on 1 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.
Which versions are affected by CVE-2021-22876?
It affects 12 products.
Linux distribution packages (4)
curl-openssl1 SUSE:Linux Enterprise Server 11-SECURITY | All versions | 7.37.0-70.60.1 |
curl SUSE:Linux Enterprise Server 12 SP5 | All versions | 7.60.0-11.15.1 |
curl SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 7.60.0-11.15.1 |
curl SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 7.60.0-11.15.1 |
Products include Broadcom Fabric Operating System, Debian Debian Linux, Fedoraproject Fedora, Haxx Libcurl, Netapp Hci Compute Node, Netapp Hci Management Node and 6 more.
How do I fix CVE-2021-22876?
Upgrade to a fixed version.
Is CVE-2021-22876 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-22876 exists.
Other vulnerabilities in Broadcom Fabric Operating System
Sources
Also known as ALPINE-CVE-2021-22876, CLEANSTART-2026-VF29502, CLSA-2021-1617285762, CLSA-2021-1634922432, CURL-CVE-2021-22876, DEBIAN-CVE-2021-22876 and 7 more.