CVE-2021-22897
Severity
5.3MEDIUM
EPSS
0.8%
top 26.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 11
Latest updateOct 15
Description
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this wea…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4
Affected Packages12 packages
Patches
🔴Vulnerability Details
3📋Vendor Advisories
4Oracle▶
Oracle Oracle JD Edwards Risk Matrix: Enterprise Infrastructure SEC (curl) — CVE-2021-22897↗2025-10-15
Microsoft▶
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The se↗2021-06-08
Debian▶
CVE-2021-22897: curl - curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong sessio...↗2021