CVE-2021-22901
published 2021-06-11CVE-2021-22901: curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over…
high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | — | — |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | >= 0 < 7.77.0-r0 | 7.77.0-r0 |
| haxx | curl | 7.75.0 – 7.76.1 | — |
| https | github.com_curl_curl | — | — |
| msrc | cbl2_curl_7.76.0-5_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_curl_7.76.0-2_on_cbl_mariner_1.0 | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | — | — |
| oracle | communications_cloud_native_core_network_repository_function | — | — |
| oracle | communications_cloud_native_core_network_repository_function | — | — |
| oracle | communications_cloud_native_core_network_slice_selection_function | — | — |
| oracle | communications_cloud_native_core_service_communication_proxy | — | — |
| oracle | essbase | < 11.1.2.4.047 | 11.1.2.4.047 |
| oracle | essbase | >= 21.0 < 21.3 | 21.3 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
osv8.1HIGH