CVE-2021-22945
published 2021-09-23CVE-2021-22945: When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and…
PriorityP354critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
6.68%
93.2th percentile
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | >= 12.0.0 < 12.3 | 12.3 |
| apple | macos_monterey | — | — |
| debian | curl | < curl 7.79.1-1 (bookworm) | curl 7.79.1-1 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| haxx | curl | >= 0 < 7.74.0-1.3+deb11u2 | 7.74.0-1.3+deb11u2 |
| haxx | curl | >= 0 < 7.79.1-1 | 7.79.1-1 |
| haxx | curl | >= 0 < 7.79.1-1 | 7.79.1-1 |
| haxx | curl | >= 0 < 7.79.1-1 | 7.79.1-1 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.16 | 7.58.0-2ubuntu3.16 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.15 | 7.58.0-2ubuntu3.15 |
| haxx | curl | >= 0 < 7.68.0-1ubuntu2.7 | 7.68.0-1ubuntu2.7 |
| haxx | libcurl | 7.73.0 – 7.78.0 | — |
| https | github.com_curl_curl | — | — |
| msrc | cbl2_curl_7.82.0-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_curl_7.76.0-6_on_cbl_mariner_1.0 | — | — |
| oracle | mysql_server | 5.7.0 – 5.7.35 | — |
| oracle | mysql_server | 8.0.0 – 8.0.26 | — |
| siemens | sinec_ins | < 1.0.1.1 | 1.0.1.1 |
| splunk | universal_forwarder | — | — |
| splunk | universal_forwarder | >= 8.2.0 < 8.2.12 | 8.2.12 |
| splunk | universal_forwarder | >= 9.0.0 < 9.0.6 | 9.0.6 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:P
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_msrc9.1CRITICAL
vendor_redhat9.1CRITICAL
vendor_ubuntu9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2021-22945: macOS Monterey 12.3
vendor_apple·2022-03-14·CVSS 9.1
CVE-2021-22945 [CRITICAL] CVE-2021-22945: macOS Monterey 12.3
Apple Security Update: About the security content of macOS Monterey 12.3
Product: macOS Monterey
Version: 12.3
CVE: CVE-2021-22945
Component: CVE-2021-22945
CISA ICS
Siemens SINEC INS
cisa_ics·2022-03-10·CVSS 5.9
[MEDIUM] Siemens SINEC INS
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEC INS
Last RevisedMarch 10, 2022
Alert CodeICSA-22-069-09
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerability: Using Components with Known Vulnerabilities
## 2. RISK EVALUATION
Successful exploitation of this vulnerability in third-party components could allow an attacker to interfere with the affected product in various ways.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Siemens reports this vulnerability affects the following SINEC INS (Infrastructure Netw
Ubuntu
curl vulnerabilities
vendor_ubuntu·2021-09-21·CVSS 9.1
[CRITICAL] curl vulnerabilities
Title: curl vulnerabilities
Summary: USN-5079-1 introduced a regression in curl.
USN-5079-1 fixed vulnerabilities in curl. One of the fixes introduced a
regression on Ubuntu 18.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that curl incorrect handled memory when sending data to
an MQTT server. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2021-22945)
Patrick Monnerat discovered that curl incorrectly handled upgrades to TLS.
When receiving certain responses from servers, curl would continue without
TLS even when the option to require a successful upgrade to TLS was
specified. (CVE-2021-22946)
Patrick Monnerat discovered
Ubuntu
curl vulnerabilities
vendor_ubuntu·2021-09-15·CVSS 9.1
CVE-2021-22947 [CRITICAL] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
It was discovered that curl incorrect handled memory when sending data to
an MQTT server. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2021-22945)
Patrick Monnerat discovered that curl incorrectly handled upgrades to TLS.
When receiving certain responses from servers, curl would continue without
TLS even when the option to require a successful upgrade to TLS was
specified. (CVE-2021-22946)
Patrick Monnerat discovered that curl incorrectly handled responses
received before STARTTLS. A remote attacker could possibly use this issue
to inject responses and intercept communications. (CVE-2021-22947)
Instructions: In ge
Red Hat
curl: use-after-free and double-free in MQTT sending
vendor_redhat·2021-09-15·CVSS 9.1
CVE-2021-22945 [CRITICAL] CWE-416 curl: use-after-free and double-free in MQTT sending
curl: use-after-free and double-free in MQTT sending
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.
A flaw was found in libcurl. When sending data to an MQTT server could in some situations lead to libcurl using already freed memory and then try to free it again. The highest threat from this vulnerability is to data confidentiality as well as system availability.
Statement: The MQTT feature is not enabled by default in any of the curl version that Red Hat ships
Package: rh-dotnet21-curl (.NET Core 2.1 on Red Hat Enterprise Linux) - Out of support scope
Package: rh-dotnet31-curl (.NET Core 3.1 on Re
Microsoft
When sending data to an MQTT server libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to
vendor_msrc·2021-09-14·CVSS 9.1
CVE-2021-22945 [CRITICAL] CWE-415 When sending data to an MQTT server libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to
When sending data to an MQTT server libcurl Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft
Debian
CVE-2021-22945: curl - When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some ...
vendor_debian·2021·CVSS 9.1
CVE-2021-22945 [CRITICAL] CVE-2021-22945: curl - When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some ...
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.
Scope: local
bookworm: resolved (fixed in 7.79.1-1)
bullseye: resolved (fixed in 7.74.0-1.3+deb11u2)
forky: resolved (fixed in 7.79.1-1)
sid: resolved (fixed in 7.79.1-1)
trixie: resolved (fixed in 7.79.1-1)
GHSA
GHSA-22mx-9r92-42g8: When sending data to an MQTT server, libcurl <= 7
ghsa_unreviewed·2022-05-24
CVE-2021-22945 [CRITICAL] CWE-415 GHSA-22mx-9r92-42g8: When sending data to an MQTT server, libcurl <= 7
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.
OSV
CVE-2021-22945: When sending data to an MQTT server, libcurl <= 7
osv·2021-09-23·CVSS 9.1
CVE-2021-22945 [CRITICAL] CVE-2021-22945: When sending data to an MQTT server, libcurl <= 7
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.
OSV
curl vulnerabilities
osv·2021-09-21·CVSS 9.1
CVE-2021-22945 [CRITICAL] curl vulnerabilities
curl vulnerabilities
USN-5079-1 fixed vulnerabilities in curl. One of the fixes introduced a
regression on Ubuntu 18.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that curl incorrect handled memory when sending data to
an MQTT server. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2021-22945)
Patrick Monnerat discovered that curl incorrectly handled upgrades to TLS.
When receiving certain responses from servers, curl would continue without
TLS even when the option to require a successful upgrade to TLS was
specified. (CVE-2021-22946)
Patrick Monnerat discovered that curl incorrectly handled responses
received before START
OSV
curl vulnerabilities
osv·2021-09-15·CVSS 9.1
CVE-2021-22945 [CRITICAL] curl vulnerabilities
curl vulnerabilities
It was discovered that curl incorrect handled memory when sending data to
an MQTT server. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2021-22945)
Patrick Monnerat discovered that curl incorrectly handled upgrades to TLS.
When receiving certain responses from servers, curl would continue without
TLS even when the option to require a successful upgrade to TLS was
specified. (CVE-2021-22946)
Patrick Monnerat discovered that curl incorrectly handled responses
received before STARTTLS. A remote attacker could possibly use this issue
to inject responses and intercept communications. (CVE-2021-22947)
No detection rules found.
No public exploits indexed.
http://seclists.org/fulldisclosure/2022/Mar/29https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://hackerone.com/reports/1269242https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/https://security.gentoo.org/glsa/202212-01https://security.netapp.com/advisory/ntap-20211029-0003/https://support.apple.com/kb/HT213183https://www.debian.org/security/2022/dsa-5197https://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://seclists.org/fulldisclosure/2022/Mar/29https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://hackerone.com/reports/1269242https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/https://security.gentoo.org/glsa/202212-01https://security.netapp.com/advisory/ntap-20211029-0003/https://support.apple.com/kb/HT213183https://www.debian.org/security/2022/dsa-5197https://www.oracle.com/security-alerts/cpuoct2021.html
2021-09-23
Published