CVE-2021-22947 Security feature bypass in https://github.com/curl/curl
A Man-In-The-Middle attacker can inject fake IMAP/POP3 responses before TLS handshake, tricking curl into trusting unauthenticated data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22947?
CVE-2021-22947 is a medium-severity vulnerability in Apple Macos, published on 29 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
Which versions are affected by CVE-2021-22947?
It affects 26 products.
Products include Apple Macos, Debian Debian Linux, Fedoraproject Fedora, Haxx Curl, Netapp Cloud Backup, Netapp Clustered Data Ontap and 20 more.
How do I fix CVE-2021-22947?
Upgrade to a fixed version.
Is CVE-2021-22947 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-22947 exists.
Other vulnerabilities in Apple Macos
Sources
Also known as ALPINE-CVE-2021-22947, AZL-6366, CLEANSTART-2026-NW23865, CURL-CVE-2021-22947, DEBIAN-CVE-2021-22947, GHSA-94jh-wwgf-cmmc and 3 more.