Vulnerability identifier: #VU55146

Vulnerability risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-22924

CWE-ID:

Exploitation vector: Network

Exploit availability:

Vulnerable software:
cURL
Client/Desktop applications / Other client software

Vendor: curl.haxx.se

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to errors in the logic when the config matching function does not take "issuer cert" into account and it compares the involved paths case insensitively. A remote attacker can gain access to sensitive information on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

cURL: 7.10.4 - 7.78.0

---

Fixed software versions

CPE

• cpe:2.3:a:curl_haxx_se:curl:7.78.0:*:*:*:*:*:*:*

External links
http://curl.haxx.se/docs/CVE-2021-22924.html

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?