Ubuntu update for curl
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2021-22945 CVE-2021-22946 CVE-2021-22947 |
| CWE-ID | CWE-415 CWE-319 CWE-345 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Ubuntu Operating systems & Components / Operating system curl (Ubuntu package) Operating systems & Components / Operating system package or component libcurl4 (Ubuntu package) Operating systems & Components / Operating system package or component libcurl3-nss (Ubuntu package) Operating systems & Components / Operating system package or component libcurl3-gnutls (Ubuntu package) Operating systems & Components / Operating system package or component |
| Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Double Free
EUVDB-ID: #VU56610
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-22945
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when sending data to an MQTT server. A remote attacker with ability to control libcurl input can trigger a double free error and perform a denial of service (DoS) attack.
Update the affected package curl to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 21.04
curl (Ubuntu package): before 7.74.0-1ubuntu2.3
libcurl4 (Ubuntu package): before 7.74.0-1ubuntu2.3
libcurl3-nss (Ubuntu package): before 7.74.0-1ubuntu2.3
libcurl3-gnutls (Ubuntu package): before 7.74.0-1ubuntu2.3
External linkshttp://ubuntu.com/security/notices/USN-5079-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Cleartext transmission of sensitive information
EUVDB-ID: #VU56613
Risk: Medium
CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-22946
CWE-ID:
CWE-319 - Cleartext Transmission of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an error, related to incorrect enforcement of the --ssl-reqd option on the command line or CURLOPT_USE_SSL setting set to CURLUSESSL_CONTROL or CURLUSESSL_ALL with libcurl. A remote attacker with control over the IMAP, POP3 or FTP server can send a specially crafted but perfectly legitimate response to the libcurl client and force it silently to continue its operations without TLS encryption and transmit data in clear text over the network.
Update the affected package curl to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 21.04
curl (Ubuntu package): before 7.74.0-1ubuntu2.3
libcurl4 (Ubuntu package): before 7.74.0-1ubuntu2.3
libcurl3-nss (Ubuntu package): before 7.74.0-1ubuntu2.3
libcurl3-gnutls (Ubuntu package): before 7.74.0-1ubuntu2.3
External linkshttp://ubuntu.com/security/notices/USN-5079-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Insufficient verification of data authenticity
EUVDB-ID: #VU56615
Risk: Medium
CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-22947
CWE-ID:
CWE-345 - Insufficient Verification of Data Authenticity
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists in the way libcurl handles the STARTTLS negotiation process. When curl connects to an IMAP, POP3, SMTP or FTP server to exchange data securely using STARTTLS to upgrade the connection to TLS level, the server can still respond and send back multiple responses before the TLS upgrade. Such multiple "pipelined" responses are cached by curl. curl would then upgrade to TLS but not flush the in-queue of cached responses and instead use and trust the responses it got before the TLS handshake as if they were authenticated.
Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
Over POP3 and IMAP an attacker can inject fake response data.
Mitigation
Update the affected package curl to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 21.04
curl (Ubuntu package): before 7.74.0-1ubuntu2.3
libcurl4 (Ubuntu package): before 7.74.0-1ubuntu2.3
libcurl3-nss (Ubuntu package): before 7.74.0-1ubuntu2.3
libcurl3-gnutls (Ubuntu package): before 7.74.0-1ubuntu2.3
External linkshttp://ubuntu.com/security/notices/USN-5079-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
