CVE-2021-22923

Name
CVE-2021-22923
Description
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://hackerone.com/reports/1213181
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
Third Party Advisory https://security.netapp.com/advisory/ntap-20210902-0003/
MISC https://www.oracle.com/security-alerts/cpuoct2021.html
Patch https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* curl >= 7.27.0 < 7.78.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status