CVE-2021-22901
published 2021-06-11CVE-2021-22901: curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over…
PriorityP266high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
60.12%
99.0th percentile
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | — | — |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | 7.75.0 – 7.76.1 | — |
| https | github.com_curl_curl | — | — |
| msrc | cbl2_curl_7.76.0-5_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_curl_7.76.0-2_on_cbl_mariner_1.0 | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | — | — |
| oracle | communications_cloud_native_core_network_repository_function | — | — |
| oracle | communications_cloud_native_core_network_repository_function | — | — |
| oracle | communications_cloud_native_core_network_slice_selection_function | — | — |
| oracle | communications_cloud_native_core_service_communication_proxy | — | — |
| oracle | essbase | < 11.1.2.4.047 | 11.1.2.4.047 |
| oracle | essbase | >= 21.0 < 21.3 | 21.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is triggered when a TLS 1.3 session ticket arrives over a reused connection (HTTP/1.1 connection reuse or HTTP/2 multiplexing) while using libcurl with OpenSSL as the TLS backend — monitor for unexpected TLS 1.3 session ticket handling on multiplexed or reused connections from curl clients ↗
- →Exploitation requires a malicious server sending crafted TLS 1.3 session tickets to a vulnerable curl client; network defenders should alert on curl versions 7.75.0–7.76.1 communicating over HTTPS/TLS 1.3 with untrusted servers ↗
- →Exploitation path includes the server causing libcurl to call a function pointer in a freed object — crash or RCE of the curl client process is the expected observable outcome; monitor for abnormal curl process crashes or unexpected code execution following HTTPS sessions ↗
- ·Vulnerability only affects libcurl when OpenSSL is used as the TLS backend; other TLS backends are not affected ↗
- ·Affected curl versions are strictly 7.75.0 through 7.76.1; versions outside this range are not vulnerable ↗
- ·Attack complexity is high — exploitation requires the connection to be shared by multiple transfers AND the server to place crafted content at the correct freed memory location; not trivially exploitable ↗
- ·No known public exploits specifically target this vulnerability as of the CISA advisory ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vendor_debian8.1LOW
vendor_msrc8.1HIGH
vendor_oracle8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vjwf-ghhc-2p8q: curl 7
ghsa_unreviewed·2022-05-24
CVE-2021-22901 [HIGH] CWE-416 GHSA-vjwf-ghhc-2p8q: curl 7
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When usi
OSV
CVE-2021-22901: curl 7
osv·2021-06-11·CVSS 8.1
CVE-2021-22901 [HIGH] CVE-2021-22901: curl 7
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When usi
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
CISA ICS
Siemens Industrial Devices using libcurl (Update B)
cisa_ics·2022-06-16
Siemens Industrial Devices using libcurl (Update B)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Industrial Devices using libcurl (Update B)
Last RevisedAugust 11, 2022
Alert CodeICSA-22-132-13
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely
- Vendor: Siemens
- Equipment: Industrial devices using libcurl
- Vulnerabilities: Use After Free
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-22-132-13 Siemens Industrial Devices using libcurl (Update A) that was published June 16, 2022, on the ICS webpage on cisa.gov/ics.
## 3. RISK EVALUATION
Successful exploitation of these vulnerabilities
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (cURL) — CVE-2021-22901
vendor_oracle·2022-04-15·CVSS 8.1
CVE-2021-22901 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (cURL) — CVE-2021-22901
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (cURL) vulnerability
CVE: CVE-2021-22901
CVSS: 8.1
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
CISA ICS
Siemens SINEC INS
cisa_ics·2022-03-10·CVSS 5.9
[MEDIUM] Siemens SINEC INS
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEC INS
Last RevisedMarch 10, 2022
Alert CodeICSA-22-069-09
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerability: Using Components with Known Vulnerabilities
## 2. RISK EVALUATION
Successful exploitation of this vulnerability in third-party components could allow an attacker to interfere with the affected product in various ways.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Siemens reports this vulnerability affects the following SINEC INS (Infrastructure Netw
Oracle
Oracle Oracle Essbase Risk Matrix: Build (cURL) — CVE-2021-22901
vendor_oracle·2022-01-15·CVSS 7.5
CVE-2021-22901 [HIGH] Oracle Oracle Essbase Risk Matrix: Build (cURL) — CVE-2021-22901
Oracle Oracle Essbase Risk Matrix: Build (cURL) vulnerability
CVE: CVE-2021-22901
CVSS: 7.5
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Oracle
Oracle Oracle MySQL Risk Matrix: Server: Packaging (curl) — CVE-2021-22901
vendor_oracle·2021-07-15·CVSS 8.1
CVE-2021-22901 [HIGH] Oracle Oracle MySQL Risk Matrix: Server: Packaging (curl) — CVE-2021-22901
Oracle Oracle MySQL Risk Matrix: Server: Packaging (curl) vulnerability
CVE: CVE-2021-22901
CVSS: 8.1
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Microsoft
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use
vendor_msrc·2021-06-08·CVSS 8.1
CVE-2021-22901 [HIGH] CWE-416 curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When usin
Red Hat
curl: Use-after-free in TLS session handling when using OpenSSL TLS backend
vendor_redhat·2021-05-26·CVSS 8.1
CVE-2021-22901 [HIGH] CWE-416 curl: Use-after-free in TLS session handling when using OpenSSL TLS backend
curl: Use-after-free in TLS session handling when using OpenSSL TLS backend
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection an
Debian
CVE-2021-22901: curl - curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting...
vendor_debian·2021·CVSS 8.1
CVE-2021-22901 [HIGH] CVE-2021-22901: curl - curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting...
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When usi
No detection rules found.
No public exploits indexed.
HackerOne
Path Traversal in curl file:// Protocol Handler Allows Unauthorized File Access
hackerone·2026-01-04
[HIGH] Path Traversal in curl file:// Protocol Handler Allows Unauthorized File Access
Path Traversal in curl file:// Protocol Handler Allows Unauthorized File Access
## Summary
During my manual review of the file path handling logic in curl's source code, I noticed the absence of proper validation for directory traversal sequences, which I then verified through practical testing. I discovered that curl allows unauthorized access to arbitrary files through the file:// protocol handler when directory traversal sequences (`../`) are used.
## Affected version
curl 8.13.0_8 (official Windows build)
Platform: Windows 10
curl version output:
curl 8.13.0 (x86_64-pc-win32) libcurl/8.13.0 OpenSSL/3.0.16 (Schannel) zlib/1.3.1 brotli/1.1.0 zstd/1.5.7 libidn2/2.3.7 libpsl/0.21.5 (+libidn2/2.3.7) libssh2/1.11.1 nghttp2/1.64.0 ngtcp2/1.12.0 nghttp3/1.8.0
Release-Date: 2025-04-02
Protoco
HackerOne
CVE-2021-22901: TLS session caching disaster
hackerone·2021-05-26·CVSS 8.1
CVE-2021-22901 [HIGH] CVE-2021-22901: TLS session caching disaster
CVE-2021-22901: TLS session caching disaster
## Summary:
lib/vtls/openssl.c `ossl_connect_step1` sets up the `ossl_new_session_cb` sessionid callback with `SSL_CTX_sess_set_new_cb`, and adds association from `data_idx` and `connectdata_idx` to current `conn` and `data` respectively:
```
SSL_CTX_set_session_cache_mode(backend->ctx,
SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL);
SSL_CTX_sess_set_new_cb(backend->ctx, ossl_new_session_cb);
```
...
```
SSL_set_ex_data(backend->handle, data_idx, data);
SSL_set_ex_data(backend->handle, connectdata_idx, conn);
```
Whenever the `ossl_new_session_cb` callback is called the code fetches the `conn` and `data` associated via:
```
conn = (struct connectdata*) SSL_get_ex_data(ssl, connectdata_idx);
if(!conn)
return 0;
data = (struct Curl_easy *)
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdfhttps://curl.se/docs/CVE-2021-22901.htmlhttps://github.com/curl/curl/commit/7f4a9a9b2a49547eae24d2e19bc5c346e9026479https://hackerone.com/reports/1180380https://security.netapp.com/advisory/ntap-20210723-0001/https://security.netapp.com/advisory/ntap-20210727-0007/https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdfhttps://curl.se/docs/CVE-2021-22901.htmlhttps://github.com/curl/curl/commit/7f4a9a9b2a49547eae24d2e19bc5c346e9026479https://hackerone.com/reports/1180380https://security.netapp.com/advisory/ntap-20210723-0001/https://security.netapp.com/advisory/ntap-20210727-0007/https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.html
2021-06-11
Published