CVE-2021-22925 Information disclosure in https://github.com/curl/curl
A flaw in curl's telnet option parser allows attackers to read uninitialized stack data, potentially revealing sensitive internal information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22925?
CVE-2021-22925 is a medium-severity vulnerability in Apple Mac Os X, published on 5 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
Which versions are affected by CVE-2021-22925?
It affects 20 products.
Products include Apple Mac Os X, Apple Macos, Fedoraproject Fedora, Haxx Curl, Netapp Cloud Backup, Netapp Clustered Data Ontap and 14 more.
How do I fix CVE-2021-22925?
Upgrade to a fixed version.
Is CVE-2021-22925 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-22925 exists.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as ALPINE-CVE-2021-22925, AZL-6363, CLEANSTART-2026-AP31271, CLSA-2021-1632261944, CLSA-2021-1634922501, CLSA-2021-1634922517 and 5 more.