CVE-2021-22890
published 2021-04-01CVE-2021-22890: curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session…
low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | < curl 7.74.0-1.2 (bookworm) | curl 7.74.0-1.2 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| haxx | curl | >= 0 < 7.74.0-1.2 | 7.74.0-1.2 |
| haxx | curl | >= 0 < 7.74.0-1.2 | 7.74.0-1.2 |
| haxx | curl | >= 0 < 7.74.0-1.2 | 7.74.0-1.2 |
| haxx | curl | >= 0 < 7.74.0-1.2 | 7.74.0-1.2 |
| haxx | curl | >= 0 < 7.47.0-1ubuntu2.19 | 7.47.0-1ubuntu2.19 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.13 | 7.58.0-2ubuntu3.13 |
| haxx | curl | >= 0 < 7.68.0-1ubuntu2.5 | 7.68.0-1ubuntu2.5 |
| haxx | libcurl | 7.63.0 – 7.75.0 | — |
| https | github.com_curl_curl | — | — |
| msrc | cm1_curl_7.76.0-5_on_cbl_mariner_1.0 | — | — |
| oracle | communications_billing_and_revenue_management | — | — |
| oracle | essbase | — | — |
| siemens | sinec_infrastructure_network_services | < 1.0.1.1 | 1.0.1.1 |
| splunk | universal_forwarder | — | — |
| splunk | universal_forwarder | >= 8.2.0 < 8.2.12 | 8.2.12 |
| splunk | universal_forwarder | >= 9.0.0 < 9.0.6 | 9.0.6 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
osv5.3MEDIUM