Man-in-the-Middle (MitM) attack in cURL - CVE-2021-22890

Vulnerability identifier: #VU51822

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22890

CWE-ID: CWE-300

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error when handling TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. The reason for this confusion is the modified sequence from TLS 1.2 when the session ids would provided only during the TLS handshake, while in TLS 1.3 it happens post hand-shake and the code was not updated to take that changed behavior into account.

When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed.

This flaw can allow a malicious HTTPS proxy to MITM the traffic. Such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

cURL
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
cflinuxfs3
IBM MaaS360 Base Module
IBM MaaS360 Ceriticate Integration Module
Gentoo Linux
SUSE MicroOS
Slackware Linux
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
Fedora
jbcs-httpd24 (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
jbcs-httpd24-jansson (Red Hat package)
curl (Alpine package)
curl (Debian package)
jbcs-httpd24-curl (Red Hat package)
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-openssl-chil (Red Hat package)
jbcs-httpd24-brotli (Red Hat package)
jbcs-httpd24-nghttp2 (Red Hat package)
libcurl3-nss (Ubuntu package)
libcurl3-gnutls (Ubuntu package)
libcurl3 (Ubuntu package)
curl (Ubuntu package)
libcurl4 (Ubuntu package)
libcurl4
curl
libcurl4-32bit-debuginfo
libcurl4-32bit
curl-debuginfo
libcurl-devel
libcurl4-debuginfo
curl-debugsource
curl-help
libcurl
Splunk Universal Forwarder
Splunk Enterprise
SINEC INS
JBoss Core Services
IBM MaaS360 VPN Module
IBM MaaS360 Cloud Extender Agent

Install updates from vendor's website.

cURL - update to 7.76.0
cflinuxfs3 - update to 0.233.0
jbcs-httpd24 (Red Hat package) - addressed in versions 1-18.el8jbcs, 1-18.jbcs.el7
jbcs-httpd24-apr-util (Red Hat package) - addressed in versions 1.6.1-82.el8jbcs, 1.6.1-82.jbcs.el7
jbcs-httpd24-apr (Red Hat package) - addressed in versions 1.6.3-105.el8jbcs, 1.6.3-105.jbcs.el7
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.7-17.el8jbcs, 1.15.7-17.jbcs.el7
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.0.8-36.el8jbcs, 2.0.8-36.jbcs.el7
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.37-74.el8jbcs, 2.4.37-74.jbcs.el7
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.2-63.GA.el8jbcs, 2.9.2-63.GA.jbcs.el7
jbcs-httpd24-jansson (Red Hat package) - addressed in versions 2.11-55.el8jbcs, 2.11-55.jbcs.el7
curl (Alpine package) - update to 7.76.0-r0
curl (Debian package) - update to 7.64.0-4+deb10u2
jbcs-httpd24-curl (Red Hat package) - addressed in versions 7.77.0-2.el8jbcs, 7.77.0-2.jbcs.el7
Splunk Universal Forwarder - addressed in versions 8.1.14, 8.2.11, 9.0.5
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
jbcs-httpd24-openssl-pkcs11 (Red Hat package) - update to 0.4.10-20.el8jbcs
jbcs-httpd24-openssl-chil (Red Hat package) - update to 1.0.0-5.el8jbcs
SINEC INS - update to 1.0.1.1
jbcs-httpd24-brotli (Red Hat package) - update to 1.0.6-40.el8jbcs
jbcs-httpd24-nghttp2 (Red Hat package) - update to 1.39.2-37.el8jbcs
JBoss Core Services - update to 2.4.37 SP8
IBM MaaS360 Base Module - update to 2.105.300.005
IBM MaaS360 VPN Module - update to 2.105.300.005
IBM MaaS360 Ceriticate Integration Module - update to 2.105.300.005
IBM MaaS360 Cloud Extender Agent - update to 2.105.300.005
libcurl3-nss (Ubuntu package) - addressed in versions 7.47.0-1ubuntu2.19, 7.58.0-2ubuntu3.13, 7.68.0-1ubuntu2.5, 7.68.0-1ubuntu4.3
libcurl3-gnutls (Ubuntu package) - addressed in versions 7.47.0-1ubuntu2.19, 7.58.0-2ubuntu3.13, 7.68.0-1ubuntu2.5, 7.68.0-1ubuntu4.3
libcurl3 (Ubuntu package) - update to 7.47.0-1ubuntu2.19
curl (Ubuntu package) - addressed in versions 7.47.0-1ubuntu2.19, 7.58.0-2ubuntu3.13, 7.68.0-1ubuntu2.5, 7.68.0-1ubuntu4.3
libcurl4 (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.13, 7.68.0-1ubuntu2.5, 7.68.0-1ubuntu4.3
libcurl4 - update to 7.66.0-4.14.1
curl - update to 7.66.0-4.14.1
libcurl4-32bit-debuginfo - update to 7.66.0-4.14.1
libcurl4-32bit - update to 7.66.0-4.14.1
curl-debuginfo - update to 7.66.0-4.14.1
libcurl-devel - update to 7.66.0-4.14.1
libcurl4-debuginfo - update to 7.66.0-4.14.1
curl-debugsource - update to 7.66.0-4.14.1
curl - addressed in versions 7.69.1-8.fc32, 7.71.1-9.fc33, 7.76.0-1.fc34
curl-help - update to 7.71.1-6
libcurl - update to 7.71.1-6
libcurl-devel - update to 7.71.1-6
curl-debuginfo - update to 7.71.1-6
curl-debugsource - update to 7.71.1-6
curl - update to 7.71.1-6

• https://curl.haxx.se/docs/CVE-2021-22890.html

• Multiple vulnerabilities in cURL
• Debian update for curl
• Slackware Linux update for curl
• Man-in-the-Middle (MitM) attack in curl (Alpine package)
• Multiple vulnerabilities in Cloud Foundry cflinuxfs3
• Gentoo update for cURL
• Red Hat update for JBoss Core Services Pack Apache Server
• Multiple vulnerabilities in Siemens SINEC INS
• SUSE update for curl
• Ubuntu update for curl
• Multiple vulnerabilities in IBM MaaS360 Cloud Extender and Modules
• Splunk Universal Forwarder update for third-party packages
• Multiple vulnerabilities in Dell Data Protection Central
• Splunk Enterprise update for third-party packages
• openEuler 20.03 LTS SP1 update for curl
• Fedora 32 update for curl
• Fedora 34 update for curl
• Fedora 33 update for curl