CVE-2021-22898

Published: Jun 11, 2021Modified: Jun 17, 2026

3.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 1.6 / Impact: 1.4

Source: NVD

Description

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

Affected (18)

Products: Haxx: Curl · Debian: Debian Linux · Fedoraproject: Fedora · +3 more

Show all products

Haxx: Curl · Debian: Debian Linux · Fedoraproject: Fedora · Oracle: Communications Cloud Native Core Binding Support Function, Communications Cloud Native Core Network Function Cloud Native Environment, Communications Cloud Native Core Network Repository Function, Communications Cloud Native Core Network Slice Selection Function, Communications Cloud Native Core Service Communication Proxy, Essbase, Mysql Server · Siemens: Sinec Infrastructure Network Services · Splunk: Universal Forwarder

1 product

1 product

1 product

7 products

Communications Cloud Native Core Binding Support Function

Communications Cloud Native Core Network Function Cloud Native Environment

Communications Cloud Native Core Network Repository Function

Communications Cloud Native Core Network Slice Selection Function

Communications Cloud Native Core Service Communication Proxy

1 product

Sinec Infrastructure Network Services

1 product

Universal Forwarder

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	From 7.7 to 7.76.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Configuration D

10 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Binding Support Function	Version 1.11.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Version 1.10.0
Oracle Communications Cloud Native Core Network Repository Function	Version 1.15.0
Oracle Communications Cloud Native Core Network Repository Function	Version 1.15.1
Oracle Communications Cloud Native Core Network Slice Selection Function	Version 1.8.0
Oracle Communications Cloud Native Core Service Communication Proxy	Version 1.15.0
Oracle Essbase	Before 11.1.2.4.047
Oracle Essbase	From 21.0 to 21.3
Oracle Mysql Server	Before 5.7.34
Oracle Mysql Server	From 8.0.15 to 8.0.25

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinec Infrastructure Network Services	Before 1.0.1.1

Configuration F

3 vulnerable

Vulnerable Software	Affected Versions
Splunk Universal Forwarder	From 8.2.0 to 8.2.12
Splunk Universal Forwarder	From 9.0.0 to 9.0.6
Splunk Universal Forwarder	Version 9.1.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Missing Initialization of Resource

The product does not initialize a critical resource.

References (28)

http://www.openwall.com/lists/oss-security/2021/07/21/4

Source: support@hackerone.com

Mailing ListPatchThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: support@hackerone.com

PatchThird Party Advisory

https://curl.se/docs/CVE-2021-22898.html

Source: support@hackerone.com

ExploitPatchVendor Advisory

https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde

Source: support@hackerone.com

PatchThird Party Advisory

https://hackerone.com/reports/1176461

Source: support@hackerone.com

ExploitIssue TrackingPatchThird Party Advisory

https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html

Source: support@hackerone.com

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q/

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://www.debian.org/security/2022/dsa-5197

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: support@hackerone.com

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/07/21/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://curl.se/docs/CVE-2021-22898.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://hackerone.com/reports/1176461

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchThird Party Advisory

https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://www.debian.org/security/2022/dsa-5197

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.