CVE-2021-22924

Published: Aug 5, 2021Modified: Jun 17, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Affected (40)

Products: Haxx: Libcurl · Fedoraproject: Fedora · Debian: Debian Linux · +4 more

Show all products

1 product

1 product

1 product

4 products

Solidfire & Hci Management Node

Solidfire Baseboard Management Controller Firmware

Oracle

2 products

Mysql Server

Peoplesoft Enterprise Peopletools

Siemens

23 products

Sinec Infrastructure Network Services

Sinema Remote Connect Server

Logo! Cmr2040 Firmware

Logo! Cmr2020 Firmware

Ruggedcomrm 1224 Lte Firmware

Scalance M804pb Firmware

Scalance M812 1 Firmware

Scalance M816 1 Firmware

Scalance M826 2 Firmware

Scalance M874 2 Firmware

Scalance M874 3 Firmware

Scalance M876 3 Firmware

Scalance M876 4 Firmware

Scalance Mum856 1 Firmware

Scalance S615 Firmware

Simatic Cp 1543 1 Firmware

Simatic Cp 1545 1 Firmware

Simatic Rtu3010c Firmware

Simatic Rtu3030c Firmware

Simatic Rtu3031c Firmware

Simatic Rtu 3041c Firmware

Sinema Remote Connect

Siplus Net Cp 1543 1 Firmware

Splunk

1 product

Universal Forwarder

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Libcurl	From 7.10.4 to 7.77.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 9.0

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Clustered Data Ontap	All versions
Netapp Solidfire & Hci Management Node	All versions
Netapp Solidfire Baseboard Management Controller Firmware	All versions

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Oracle Mysql Server	From 5.7.0 to 5.7.36
Oracle Mysql Server	From 8.0.0 to 8.0.26
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinec Infrastructure Network Services	Before 1.0.1.1
Siemens Sinema Remote Connect Server	Before 3.1

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Logo! Cmr2040 Firmware	All versions

Running on/with	Platform Versions
Siemens Logo! Cmr2040	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Logo! Cmr2020 Firmware	All versions

Running on/with	Platform Versions
Siemens Logo! Cmr2020	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Ruggedcomrm 1224 Lte Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Ruggedcomrm 1224 Lte	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance M804pb Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Scalance M804pb	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance M812 1 Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Scalance M812 1	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance M816 1 Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Scalance M816 1	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance M826 2 Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Scalance M826 2	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance M874 2 Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Scalance M874 2	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance M874 3 Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Scalance M874 3	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance M876 3 Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Scalance M876 3	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance M876 4 Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Scalance M876 4	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Mum856 1 Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Scalance Mum856 1	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance S615 Firmware	Before 7.1

Running on/with	Platform Versions
Siemens Scalance S615	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Cp 1543 1 Firmware	Before 3.0.22

Running on/with	Platform Versions
Siemens Simatic Cp 1543 1	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Cp 1545 1 Firmware	Before 1.1

Running on/with	Platform Versions
Siemens Simatic Cp 1545 1	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Rtu3010c Firmware	Before 5.0.14

Running on/with	Platform Versions
Siemens Simatic Rtu3010c	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Rtu3030c Firmware	Before 5.0.14

Running on/with	Platform Versions
Siemens Simatic Rtu3030c	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Rtu3031c Firmware	Before 5.0.14

Running on/with	Platform Versions
Siemens Simatic Rtu3031c	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Rtu 3041c Firmware	Before 5.0.14

Running on/with	Platform Versions
Siemens Simatic Rtu 3041c	All versions

Configuration Z

1 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinema Remote Connect	Before 3.1

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Siplus Net Cp 1543 1 Firmware	Before 3.0.22

Running on/with	Platform Versions
Siemens Siplus Net Cp 1543 1	All versions

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Splunk Universal Forwarder	From 8.2.0 to 8.2.12
Splunk Universal Forwarder	From 9.0.0 to 9.0.6
Splunk Universal Forwarder	Version 9.1.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-706

Use of Incorrectly-Resolved Name or Reference

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

References (30)

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: support@hackerone.com

PatchThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

Source: support@hackerone.com

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf

Source: support@hackerone.com

Third Party Advisory

https://hackerone.com/reports/1223565

Source: support@hackerone.com

ExploitIssue TrackingPatchThird Party Advisory

https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20210902-0003/

Source: support@hackerone.com

Third Party Advisory

https://www.debian.org/security/2022/dsa-5197

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf