5.3
CVE-2021-22897
- EPSS 2.98%
- Veröffentlicht 11.06.2021 16:15:10
- Zuletzt bearbeitet 28.05.2026 21:16:27
- Erkennungen
Logincurl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Communications Cloud Native Core Binding Support Function Version 1.11.0
Oracle ≫ Communications Cloud Native Core Network Repository Function Version 1.15.0
Oracle ≫ Communications Cloud Native Core Network Repository Function Version 1.15.1
Oracle ≫ Communications Cloud Native Core Service Communication Proxy Version 1.15.0
Oracle ≫ Mysql Server Version <= 5.7.34
Oracle ≫ Mysql Server Version >= 8.0.0 <= 8.0.25
Netapp ≫ Cloud Backup Version -
Netapp ≫ Hci Compute Node Firmware Version -
Netapp ≫ H300e Firmware Version -
Netapp ≫ H300s Firmware Version -
Netapp ≫ H410s Firmware Version -
Netapp ≫ H500e Firmware Version -
Netapp ≫ H500s Firmware Version -
Netapp ≫ H700e Firmware Version -
Netapp ≫ H700s Firmware Version -
Siemens ≫ Sinec Infrastructure Network Services Version < 1.0.1.1
Splunk ≫ Universal Forwarder Version >= 8.2.0 < 8.2.12
Splunk ≫ Universal Forwarder Version >= 9.0.0 < 9.0.6
Splunk ≫ Universal Forwarder Version 9.1.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.98% | 0.855 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:P/I:N/A:N
|
| CISA-ADP | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
CWE-668 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com//security-alerts/cpujul2021.html
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
https://curl.se/docs/CVE-2021-22897.html
https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511
https://hackerone.com/reports/1172857
https://security.netapp.com/advisory/ntap-20210727-0007/