CVE-2021-22947

Publication date 15 September 2021

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
curl	22.04 LTS jammy	Fixed 7.74.0-1.3ubuntu2
	21.10 impish	Fixed 7.74.0-1.3ubuntu2
	21.04 hirsute	Fixed 7.74.0-1ubuntu2.3
	20.04 LTS focal	Fixed 7.68.0-1ubuntu2.7
	18.04 LTS bionic	Fixed 7.58.0-2ubuntu3.15
	16.04 LTS xenial	Fixed 7.47.0-1ubuntu2.19+esm1 Ubuntu Pro
	14.04 LTS trusty	Fixed 7.35.0-1ubuntu2.20+esm8 Ubuntu Pro

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

alexmurray

Originally introduced via https://github.com/curl/curl/commit/ec3bb8f727405 - affects versions between and including 7.20.0 and 7.78.0 - patch in Message-ID: <nycvar.QRO.7.76.2109100828320.2614@fvyyl>

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N