Home

CVE-2021-22898

Description

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

Risk Information

Base Score
3.1
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS Score
Exploitation Probability
0.126

Associated Vulnerability

VulnerabilityOS Platform
Vulnerability CVE-2021-22897,CVE-2021-22898,CVE-2021-22901 are affected in Curl For Windows 7.76.1Windows
Vulnerabilities CVE-2021-22901,CVE-2021-22898,CVE-2021-22897 are fixed in Curl For Windows 7.77.0Windows
SUSE-SU-2021:1763-1(SUSE Linux Enterprise Server 12-SP5 ) curl-7.60.0-11.18.1.x86_64.rpmLinux
SUSE-SU-2021:1763-1(SUSE Linux Enterprise Server 12-SP5 ) curl-debuginfo-7.60.0-11.18.1.x86_64.rpmLinux
SUSE-SU-2021:1763-1(SUSE Linux Enterprise Server 12-SP5 ) curl-debugsource-7.60.0-11.18.1.x86_64.rpmLinux
SUSE-SU-2021:1763-1(SUSE Linux Enterprise Server 12-SP5 ) libcurl4-7.60.0-11.18.1.x86_64.rpmLinux
SUSE-SU-2021:1763-1(SUSE Linux Enterprise Server 12-SP5 ) libcurl4-32bit-7.60.0-11.18.1.x86_64.rpmLinux
SUSE-SU-2021:1763-1(SUSE Linux Enterprise Server 12-SP5 ) libcurl4-debuginfo-7.60.0-11.18.1.x86_64.rpmLinux
SUSE-SU-2021:1763-1(SUSE Linux Enterprise Server 12-SP5 ) libcurl4-debuginfo-32bit-7.60.0-11.18.1.x86_64.rpmLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) curl_7.68.0-1ubuntu2.6_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) curl_7.68.0-1ubuntu2.6_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) curl_7.74.0-1ubuntu2.1_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) curl_7.74.0-1ubuntu2.1_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) curl_7.58.0-2ubuntu3.14_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) curl_7.58.0-2ubuntu3.14_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl4_7.68.0-1ubuntu2.6_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl4_7.68.0-1ubuntu2.6_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl4_7.74.0-1ubuntu2.1_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl4_7.74.0-1ubuntu2.1_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl4_7.58.0-2ubuntu3.14_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl4_7.58.0-2ubuntu3.14_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-nss_7.68.0-1ubuntu2.6_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-nss_7.68.0-1ubuntu2.6_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-nss_7.74.0-1ubuntu2.1_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-nss_7.74.0-1ubuntu2.1_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-nss_7.58.0-2ubuntu3.14_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-nss_7.58.0-2ubuntu3.14_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-gnutls_7.68.0-1ubuntu2.6_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-gnutls_7.68.0-1ubuntu2.6_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-gnutls_7.74.0-1ubuntu2.1_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-gnutls_7.74.0-1ubuntu2.1_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-gnutls_7.58.0-2ubuntu3.14_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-5021-1) libcurl3-gnutls_7.58.0-2ubuntu3.14_amd64.debLinux
(RHSA-2021:4511) curl security and bug fix update curl-debugsource-7.61.1-22.el8.i686.rpmLinux
(RHSA-2021:4511) curl security and bug fix update curl-debugsource-7.61.1-22.el8.x86_64.rpmLinux
(RHSA-2021:4511) curl security and bug fix update libcurl-minimal-7.61.1-22.el8.i686.rpmLinux
(RHSA-2021:4511) curl security and bug fix update libcurl-minimal-7.61.1-22.el8.x86_64.rpmLinux
curl security update(DSA-5197-1) curl_7.74.0-1.3+deb11u2_amd64.debLinux
Missing Initialization of Resource Vulnerability (CVE-2021-22898)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234