CVE-2021-22946 Security feature bypass in https://github.com/curl/curl
Attackers can bypass TLS enforcement in curl for IMAP, POP3, or FTP, causing sensitive data to be transmitted in clear text.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22946?
CVE-2021-22946 is a high-severity vulnerability in Apple Macos, published on 29 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
Which versions are affected by CVE-2021-22946?
It affects 29 products.
Products include Apple Macos, Debian Debian Linux, Fedoraproject Fedora, Haxx Curl, Netapp Cloud Backup, Netapp Clustered Data Ontap and 23 more.
How do I fix CVE-2021-22946?
Upgrade to a fixed version.
Is CVE-2021-22946 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-22946 exists.
Other vulnerabilities in Apple Macos
Sources
Also known as ALPINE-CVE-2021-22946, AZL-6365, CLEANSTART-2026-HL19733, CURL-CVE-2021-22946, DEBIAN-CVE-2021-22946, ECHO-e654-6dd5-09ec and 3 more.