CVE-2021-22922 Business logic in https://github.com/curl/curl
Attackers can deliver malicious files via compromised metalink servers because curl fails to delete files with hash mismatches, requiring the metalink feature to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-22922?
CVE-2021-22922 is a medium-severity vulnerability in Fedoraproject Fedora, published on 5 Aug 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.
Which versions are affected by CVE-2021-22922?
It affects 16 products.
Products include Fedoraproject Fedora, Haxx Curl, Netapp Cloud Backup, Netapp Clustered Data Ontap, Netapp H300e Firmware, Netapp H300s Firmware and 10 more.
How do I fix CVE-2021-22922?
Upgrade to a fixed version.
Is CVE-2021-22922 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-22922 exists.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2021-22922, AZL-6361, CLEANSTART-2026-LX97810, CURL-CVE-2021-22922, DEBIAN-CVE-2021-22922, GHSA-975f-fvhv-8mhx and 1 more.