Read the docs
TI-2021-05808 Aliases CVE-2021-22947GHSA-94jh-wwgf-cmmc

Cryptographic flaw in https://github.com/curl/curl

Priority MEDIUM 60CWE-310Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 5 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-345.

Summary

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03009 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 3 advisoriesRed Hat: 5 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/curl/curlcurl 7.20.0 to and including 7.78.0—No fix listedCNA
  • https://github.com/curl/curl Vendor— Affected curl 7.20.0 to and including 7.78.0 Fixed in — No fix listed CNA

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*7.20.0 to before 7.79.0VulnerableHaxx
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
  • cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.20.0 to before 7.79.0 Vulnerable ·Haxx
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*1.15.1VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*5.7.0 – 5.7.35; 8.0.0 – 8.0.26VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*before 1.0.1.1VulnerableSiemens
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*before 12.3VulnerableApple
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*22.1.3VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:*22.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:*22.1.2VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:*22.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:*22.1.1VulnerableOracle
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6VulnerableSplunk
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableSplunk
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:* Versions 1.15.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions 5.7.0 – 5.7.35; 8.0.0 – 8.0.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* Versions before 1.0.1.1 Vulnerable ·Siemens
  • cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 12.3 Vulnerable ·Apple
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* Versions 22.1.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:* Versions 22.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:* Versions 22.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:* Versions 22.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:* Versions 22.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* Versions 8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6 Vulnerable ·Splunk
  • cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Splunk

Remediation

Red Hat 3 advisories

  • RHSA-2022:1354 Released 2022-04-13 · Red Hat rating Moderate
    rh-dotnet31-curl security update
    • .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet31-curl-7.61.1-22.el7_9, rh-dotnet31-libcurl-7.61.1-22.el7_9, rh-dotnet31-libcurl-devel-7.61.1-22.el7_9
    • .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet31-curl-7.61.1-22.el7_9, rh-dotnet31-libcurl-7.61.1-22.el7_9, rh-dotnet31-libcurl-devel-7.61.1-22.el7_9
    • .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet31-curl-7.61.1-22.el7_9, rh-dotnet31-libcurl-7.61.1-22.el7_9, rh-dotnet31-libcurl-devel-7.61.1-22.el7_9
  • RHSA-2022:0635 Released 2022-02-22 · Red Hat rating Moderate
    curl security update
    • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) curl-7.61.1-12.el8_2.4, libcurl-7.61.1-12.el8_2.4, libcurl-devel-7.61.1-12.el8_2.4 +1
  • RHSA-2021:4059 Released 2021-11-02 · Red Hat rating Moderate
    curl security update
    • Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-18.el8_4.2, libcurl-7.61.1-18.el8_4.2, libcurl-devel-7.61.1-18.el8_4.2 +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    https://github.com/curl/curl — FEDORA-2021-1d24845e93

    3 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM

    Other records, highest priority first

    • TI-2021-05807 Cleartext transmission of sensitive information in https://github.com/curl/curlPriority HIGH 72
    • TI-2021-05806 Double free in https://github.com/curl/curlPriority MEDIUM 55
    Show all 3 records → Advisory →
  • Advisory ·

    https://github.com/curl/curl — FEDORA-2021-fc96a3a749

    3 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM

    Other records, highest priority first

    • TI-2021-05807 Cleartext transmission of sensitive information in https://github.com/curl/curlPriority HIGH 72
    • TI-2021-05806 Double free in https://github.com/curl/curlPriority MEDIUM 55
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
.NET Core 2.1 on Red Hat Enterprise LinuxAffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Software CollectionsAffectedNo fix yet
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2022:1354
.NET Core on Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2022:1354
.NET Core on Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2022:1354
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2021:4059
Red Hat Enterprise Linux BaseOS EUS (v. 8.2)Fixed RHSA-2022:0635
Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Core Services

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22947
  2. 2026-10-03 Alias added: GHSA-94jh-wwgf-cmmc

References

Exploit 1

Patch 5

Advisory 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences