CVE - CVE-2021-22897

CVE-ID
CVE-2021-22897	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf URL:https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf CONFIRM:https://security.netapp.com/advisory/ntap-20210727-0007/ URL:https://security.netapp.com/advisory/ntap-20210727-0007/ MISC:https://curl.se/docs/CVE-2021-22897.html URL:https://curl.se/docs/CVE-2021-22897.html MISC:https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511 URL:https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511 MISC:https://hackerone.com/reports/1172857 URL:https://hackerone.com/reports/1172857 MISC:https://www.oracle.com//security-alerts/cpujul2021.html URL:https://www.oracle.com//security-alerts/cpujul2021.html MISC:https://www.oracle.com/security-alerts/cpuapr2022.html URL:https://www.oracle.com/security-alerts/cpuapr2022.html MISC:https://www.oracle.com/security-alerts/cpujan2022.html URL:https://www.oracle.com/security-alerts/cpujan2022.html
Assigning CNA
HackerOne
Date Record Created
20210106	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210106)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)