CVE-2021-22924 Other in https://github.com/curl/curl
libcurl may reuse connections with incorrect TLS settings due to flawed path comparison, potentially bypassing certificate verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22924?
CVE-2021-22924 is a low-severity vulnerability in Debian Debian Linux, published on 5 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.
Which versions are affected by CVE-2021-22924?
It affects 33 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Haxx Libcurl, Netapp Cloud Backup, Netapp Clustered Data Ontap, Netapp Solidfire \& Hci Management Node and 27 more.
How do I fix CVE-2021-22924?
Upgrade to a fixed version.
Is CVE-2021-22924 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-22924 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-22924, AZL-6367, CLEANSTART-2026-JE81585, CLSA-2021-1632262236, CLSA-2021-1634922534, CLSA-2021-1635459168 and 6 more.