Improper Certificate Validation in cURL - CVE-2021-22924

Vulnerability identifier: #VU55146

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22924

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to errors in the logic when the config matching function does not take "issuer cert" into account and it compares the involved paths case insensitively. A remote attacker can gain access to sensitive information on the system.

cURL
WD Cloud
My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
Amazon Linux AMI
Arch Linux
SUSE Manager Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE MicroOS
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
Fedora
My Cloud OS 5
My Cloud
cflinuxfs3
Red Hat Advanced Cluster Management for Kubernetes
EasyApache
IBM Cloud Private
Splunk Universal Forwarder
Splunk Enterprise
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
curl-openssl1
libcurl4-openssl1
libcurl4-openssl1-32bit
libcurl4-openssl1-x86
libcurl3-gnutls (Ubuntu package)
libcurl3-nss (Ubuntu package)
libcurl4 (Ubuntu package)
curl (Ubuntu package)
curl
curl-debuginfo
curl-debugsource
libcurl-devel
libcurl4
libcurl4-debuginfo
libcurl4-32bit
libcurl4-32bit-debuginfo
libcurl4-debuginfo-32bit
libcurl-minimal
libcurl
curl (Red Hat package)
rh-dotnet31-curl (Red Hat package)
curl-help
curl (Debian package)
SINEC INS
SINEMA Remote Connect Server
OpenShift Virtualization
Dell EMC VxRail Appliance

Install updates from vendor's website.

cURL - update to 7.78.0
cflinuxfs3 - update to 0.250.0
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.1.11, 2.1.12, 2.3.3
IBM Cloud Private - addressed in versions 3.2.1.2203, 3.2.2.2203
EasyApache - update to 4 2021-7-28
Splunk Universal Forwarder - addressed in versions 8.1.14, 8.2.11, 9.0.5
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
SINEC INS - update to 1.0.1.1
OpenShift Virtualization - addressed in versions 2.6.8, 4.9.0
SINEMA Remote Connect Server - update to 3.1
My Cloud OS 5 - update to 5.25.124
Dell EMC VxRail Appliance - update to 7.0.203
curl-openssl1 - update to 7.37.0-70.71.1
libcurl4-openssl1 - update to 7.37.0-70.71.1
libcurl4-openssl1-32bit - update to 7.37.0-70.71.1
libcurl4-openssl1-x86 - update to 7.37.0-70.71.1
libcurl3-gnutls (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.14, 7.68.0-1ubuntu2.6, 7.74.0-1ubuntu2.1
libcurl3-nss (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.14, 7.68.0-1ubuntu2.6, 7.74.0-1ubuntu2.1
libcurl4 (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.14, 7.68.0-1ubuntu2.6, 7.74.0-1ubuntu2.1
curl (Ubuntu package) - addressed in versions 7.58.0-2ubuntu3.14, 7.68.0-1ubuntu2.6, 7.74.0-1ubuntu2.1
curl - addressed in versions 7.60.0-3.47.1, 7.60.0-4.25.1, 7.60.0-11.23.1, 7.66.0-4.22.1
curl-debuginfo - addressed in versions 7.60.0-3.47.1, 7.60.0-4.25.1, 7.60.0-11.23.1, 7.66.0-4.22.1
curl-debugsource - addressed in versions 7.60.0-3.47.1, 7.60.0-4.25.1, 7.60.0-11.23.1, 7.66.0-4.22.1
libcurl-devel - addressed in versions 7.60.0-3.47.1, 7.60.0-11.23.1, 7.66.0-4.22.1
libcurl4 - addressed in versions 7.60.0-3.47.1, 7.60.0-4.25.1, 7.60.0-11.23.1, 7.66.0-4.22.1
libcurl4-debuginfo - addressed in versions 7.60.0-3.47.1, 7.60.0-4.25.1, 7.60.0-11.23.1, 7.66.0-4.22.1
libcurl4-32bit - addressed in versions 7.60.0-3.47.1, 7.60.0-4.25.1, 7.60.0-11.23.1, 7.66.0-4.22.1
libcurl4-32bit-debuginfo - addressed in versions 7.60.0-3.47.1, 7.66.0-4.22.1
libcurl4-debuginfo-32bit - addressed in versions 7.60.0-4.25.1, 7.60.0-11.23.1
libcurl-minimal - update to 7.61.1-18
libcurl-devel - update to 7.61.1-18
libcurl - update to 7.61.1-18
curl - update to 7.61.1-18
curl (Red Hat package) - update to 7.61.1-18.el8_4.1
rh-dotnet31-curl (Red Hat package) - update to 7.61.1-22.el7_9
libcurl-devel - update to 7.71.1-9
curl-help - update to 7.71.1-9
libcurl - update to 7.71.1-9
curl-debugsource - update to 7.71.1-9
curl-debuginfo - update to 7.71.1-9
curl - update to 7.71.1-9
curl - addressed in versions 7.71.1-10.fc33, 7.76.1-7.fc34
curl (Debian package) - update to 7.74.0-1.3+deb11u2

• https://curl.haxx.se/docs/CVE-2021-22924.html

• Multiple vulnerabilities in cURL
• Slackware Linux update for curl
• Arch Linux update for libcurl-compat
• Arch Linux update for lib32-curl
• Arch Linux update for curl
• Arch Linux update for lib32-libcurl-compat
• Arch Linux update for libcurl-gnutls
• Arch Linux update for lib32-libcurl-gnutls
• cPanel EasyApache 4 update for libcurl
• Multiple vulnerabilities in Cloud Foundry cflinuxfs3
• Amazon Linux AMI update for curl
• Red Hat Enterprise Linux 8.4 update for curl
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.1
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Siemens SINEC INS
• IBM Cloud Private update for curl
• SUSE update for curl
• SUSE update for curl
• SUSE update for curl
• SUSE update for curl
• SUSE update for curl
• Multiple vulnerabilities in Siemens SINEMA Remote Connect Server
• Ubuntu update for curl
• Debian update for curl
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Western Digital My Cloud OS 5
• .NET Core on Red Hat Enterprise Linux update for rh-dotnet31-curl
• Splunk Universal Forwarder update for third-party packages
• Splunk Enterprise update for third-party packages
• openEuler update for curl
• Fedora 34 update for curl
• Fedora 33 update for curl
• Anolis OS update for curl (Anolis OS 8.4)