CVE-2021-22946

Published: Sep 29, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Affected (41)

Products: Haxx: Curl · Debian: Debian Linux · Fedoraproject: Fedora · +5 more

Show all products

Haxx: Curl · Debian: Debian Linux · Fedoraproject: Fedora · Netapp: Cloud Backup, Clustered Data Ontap, Oncommand Insight, Oncommand Workflow Automation, Snapcenter, H300s Firmware, H500s Firmware, H700s Firmware, H300e Firmware, H500e Firmware, H700e Firmware, H410s Firmware, Solidfire Baseboard Management Controller Firmware · Oracle: Communications Cloud Native Core Binding Support Function, Communications Cloud Native Core Network Function Cloud Native Environment, Communications Cloud Native Core Network Repository Function, Communications Cloud Native Core Network Slice Selection Function, Communications Cloud Native Core Service Communication Proxy, Mysql Server, Peoplesoft Enterprise Peopletools, Commerce Guided Search, Communications Cloud Native Core Console, Communications Cloud Native Core Security Edge Protection Proxy · Apple: Macos · Siemens: Sinec Infrastructure Network Services · Splunk: Universal Forwarder

1 product

1 product

1 product

13 products

Oncommand Workflow Automation

Solidfire Baseboard Management Controller Firmware

Oracle

10 products

Communications Cloud Native Core Binding Support Function

Communications Cloud Native Core Network Function Cloud Native Environment

Communications Cloud Native Core Network Repository Function

Communications Cloud Native Core Network Slice Selection Function

Communications Cloud Native Core Service Communication Proxy

Mysql Server

Peoplesoft Enterprise Peopletools

Commerce Guided Search

Communications Cloud Native Core Console

Communications Cloud Native Core Security Edge Protection Proxy

Apple

1 product

Macos

Siemens

1 product

Sinec Infrastructure Network Services

Splunk

1 product

Universal Forwarder

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	From 7.20.0 to 7.79.0

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 9.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 35

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Clustered Data Ontap	All versions
Netapp Oncommand Insight	All versions
Netapp Oncommand Workflow Automation	All versions
Netapp Snapcenter	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300e Firmware	All versions

Running on/with	Platform Versions
Netapp H300e	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500e Firmware	All versions

Running on/with	Platform Versions
Netapp H500e	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700e Firmware	All versions

Running on/with	Platform Versions
Netapp H700e	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Solidfire Baseboard Management Controller Firmware	All versions

Running on/with	Platform Versions
Netapp Solidfire Baseboard Management Controller	All versions

Configuration M

11 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Binding Support Function	Version 1.11.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Version 1.10.0
Oracle Communications Cloud Native Core Network Repository Function	Version 1.15.0
Oracle Communications Cloud Native Core Network Repository Function	Version 1.15.1
Oracle Communications Cloud Native Core Network Slice Selection Function	Version 1.8.0
Oracle Communications Cloud Native Core Service Communication Proxy	Version 1.15.0
Oracle Mysql Server	From 5.7.0 to 5.7.35
Oracle Mysql Server	From 8.0.0 to 8.0.26
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59

Configuration N

1 vulnerable

Vulnerable Software	Affected Versions
Apple Macos	Before 12.3

Configuration O

1 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinec Infrastructure Network Services	Before 1.0.1.1

Configuration P

6 vulnerable

Vulnerable Software	Affected Versions
Oracle Commerce Guided Search	Version 11.3.2
Oracle Communications Cloud Native Core Binding Support Function	Version 22.1.3
Oracle Communications Cloud Native Core Console	Version 22.2.0
Oracle Communications Cloud Native Core Network Repository Function	Version 22.1.0
Oracle Communications Cloud Native Core Network Repository Function	Version 22.2.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy	Version 22.1.1

Configuration Q

3 vulnerable

Vulnerable Software	Affected Versions
Splunk Universal Forwarder	From 8.2.0 to 8.2.12
Splunk Universal Forwarder	From 9.0.0 to 9.0.6
Splunk Universal Forwarder	Version 9.1.0

Related CWEs

CWE-319

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

CWE-325

Missing Cryptographic Step

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

References (32)

http://seclists.org/fulldisclosure/2022/Mar/29

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: support@hackerone.com

PatchThird Party Advisory

https://hackerone.com/reports/1334111

Source: support@hackerone.com

ExploitIssue TrackingPatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202212-01

Source: support@hackerone.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20211029-0003/

Source: support@hackerone.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220121-0008/

Source: support@hackerone.com

Third Party Advisory

https://support.apple.com/kb/HT213183

Source: support@hackerone.com

Release NotesThird Party Advisory

https://www.debian.org/security/2022/dsa-5197

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: support@hackerone.com

PatchThird Party Advisory

http://seclists.org/fulldisclosure/2022/Mar/29