Inadequate encryption strength in cURL - CVE-2021-22897

Vulnerability identifier: #VU53584

CSH Severity: Low

CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22897

CWE-ID: CWE-326

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to force applications use weak cryptographic ciphers.

The vulnerability exists due to a logic error when selecting TLS ciphers during connection via the CURLOPT_SSL_CIPHER_LIST option in libcurl. The selected cipher set was stored in a single "static" variable in the library that is used for multiple concurrent transfers within the specific application, the last one that sets the ciphers will accidentally control the set used by all transfers.

The vulnerability can be triggered when Schannel is used, which is the native TLS library in Microsoft Windows.

cURL
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
IBM MaaS360 Base Module
IBM MaaS360 Ceriticate Integration Module
EasyApache
IBM MaaS360 Cloud Extender Agent
IBM Cloud Transformation Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Splunk Universal Forwarder
Splunk Enterprise
JD Edwards EnterpriseOne Tools
Slackware Linux
openEuler
SINEC INS
IBM MaaS360 VPN Module
curl
curl-debugsource
libcurl
libcurl-devel
curl-debuginfo
curl-help

Install updates from vendor's website.

cURL - update to 7.77.0
EasyApache - update to 4 2021-6-2
Splunk Universal Forwarder - addressed in versions 8.1.14, 8.2.11, 9.0.5
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
SINEC INS - update to 1.0.1.1
IBM MaaS360 Base Module - update to 2.105.300.005
IBM MaaS360 VPN Module - update to 2.105.300.005
IBM MaaS360 Ceriticate Integration Module - update to 2.105.300.005
IBM MaaS360 Cloud Extender Agent - update to 2.105.300.005
IBM Cloud Transformation Advisor - update to 3.10.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.5
curl - update to 7.71.1-7
curl-debugsource - update to 7.71.1-7
libcurl - update to 7.71.1-7
libcurl-devel - update to 7.71.1-7
curl-debuginfo - update to 7.71.1-7
curl-help - update to 7.71.1-7

• https://curl.haxx.se/docs/CVE-2021-22897.html

• Multiple vulnerabilities in cURL
• Slackware Linux update for curl
• cPanel update for EasyApache
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple vulnerabilities in IBM MaaS360 Cloud Extender and Modules
• Splunk Universal Forwarder update for third-party packages
• Multiple vulnerabilities in Dell Data Protection Central
• Splunk Enterprise update for third-party packages
• openEuler 20.03 LTS SP1 update for curl
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools