9.1

CVE-2021-22945

Exploit
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Haxx ≫ Libcurl Version >= 7.73.0 <= 7.78.0
Fedoraproject ≫ Fedora Version 33
Fedoraproject ≫ Fedora Version 35
Netapp ≫ Cloud Backup Version -
Oracle ≫ Mysql Server Version >= 5.7.0 <= 5.7.35
Oracle ≫ Mysql Server Version >= 8.0.0 <= 8.0.26
Netapp ≫ H300s Firmware Version -
   Netapp ≫ H300s Version -
Netapp ≫ H500s Firmware Version -
   Netapp ≫ H500s Version -
Netapp ≫ H700s Firmware Version -
   Netapp ≫ H700s Version -
Netapp ≫ H300e Firmware Version -
   Netapp ≫ H300e Version -
Netapp ≫ H500e Firmware Version -
   Netapp ≫ H500e Version -
Netapp ≫ H700e Firmware Version -
   Netapp ≫ H700e Version -
Netapp ≫ H410s Firmware Version -
   Netapp ≫ H410s Version -
Apple ≫ macOS Version >= 12.0.0 < 12.3
Siemens ≫ Sinec Ins Version < 1.0.1.1
Debian ≫ Debian Linux Version 11.0
Splunk ≫ Universal Forwarder Version >= 8.2.0 < 8.2.12
Splunk ≫ Universal Forwarder Version >= 9.0.0 < 9.0.6
Splunk ≫ Universal Forwarder Version 9.1.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 6.68% 0.931
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:N/A:P
CISA-ADP 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-415 Double Free

The product calls free() twice on the same memory address.

https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
Third Party Advisory
https://www.debian.org/security/2022/dsa-5197
Third Party Advisory
http://seclists.org/fulldisclosure/2022/Mar/29
Third Party Advisory
Mailing List
https://support.apple.com/kb/HT213183
Third Party Advisory
https://security.gentoo.org/glsa/202212-01
Third Party Advisory
https://hackerone.com/reports/1269242
Patch
Third Party Advisory
Exploit
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20211029-0003/
Third Party Advisory