5.3

CVE-2021-22925

Exploit
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Haxx ≫ Curl Version >= 7.7 < 7.78.0
Fedoraproject ≫ Fedora Version 33
Netapp ≫ Cloud Backup Version -
Netapp ≫ Hci Management Node Version -
Netapp ≫ Solidfire Version -
Apple ≫ macOS X Version 10.15.7 Update -
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-001
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-002
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-003
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-004
Apple ≫ macOS Version 11.0
Apple ≫ macOS Version 11.0.1
Apple ≫ macOS Version 11.1
Apple ≫ macOS Version 11.1.0
Apple ≫ macOS Version 11.2
Apple ≫ macOS Version 11.2.1
Apple ≫ macOS Version 11.3
Apple ≫ macOS Version 11.3.1
Apple ≫ macOS Version 11.4
Apple ≫ macOS Version 11.5
Oracle ≫ Mysql Server Version >= 5.7.0 <= 5.7.35
Oracle ≫ Mysql Server Version >= 8.0.0 <= 8.0.26
Netapp ≫ H300s Firmware Version -
   Netapp ≫ H300s Version -
Netapp ≫ H500s Firmware Version -
   Netapp ≫ H500s Version -
Netapp ≫ H700s Firmware Version -
   Netapp ≫ H700s Version -
Netapp ≫ H300e Firmware Version -
   Netapp ≫ H300e Version -
Netapp ≫ H500e Firmware Version -
   Netapp ≫ H500e Version -
Netapp ≫ H700e Firmware Version -
   Netapp ≫ H700e Version -
Netapp ≫ H410s Firmware Version -
   Netapp ≫ H410s Version -
Splunk ≫ Universal Forwarder Version >= 8.2.0 < 8.2.12
Splunk ≫ Universal Forwarder Version >= 9.0.0 < 9.0.6
Splunk ≫ Universal Forwarder Version 9.1.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.93% 0.91
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CISA-ADP 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

http://seclists.org/fulldisclosure/2021/Sep/39
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2021/Sep/40
Third Party Advisory
Mailing List
https://support.apple.com/kb/HT212804
Third Party Advisory
https://support.apple.com/kb/HT212805
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
Third Party Advisory
Mailing List
https://security.gentoo.org/glsa/202212-01
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210902-0003/
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
Third Party Advisory
https://hackerone.com/reports/1223882
Patch
Third Party Advisory
Exploit
Issue Tracking