CVE-2021-22898: curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in…

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux9.0
• fedoraproject fedora33
• fedoraproject fedora34
• haxx curl7.7 and later · up to 7.76.1 inclusive
• oracle communications cloud native core binding support function1.11.0
• oracle communications cloud native core network function cloud native environment1.10.0
• oracle communications cloud native core network repository function1.15.0
• oracle communications cloud native core network repository function1.15.1
• oracle communications cloud native core network slice selection function1.8.0
• oracle communications cloud native core service communication proxy1.15.0
• oracle essbasebefore 11.1.2.4.047
• oracle essbase21.0 and later · before 21.3
• oracle mysql serverbefore 5.7.34
• oracle mysql server8.0.15 and later · before 8.0.25
• siemens sinec infrastructure network servicesbefore 1.0.1.1
• splunk universal forwarder8.2.0 and later · before 8.2.12
• splunk universal forwarder9.0.0 and later · before 9.0.6
• splunk universal forwarder9.1.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hackerone). Independent of NVD's CPE analysis and usually ahead of it.

• n/a https://github.com/curl/curl

  • 7.7 through 7.76.1affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2021-22901curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session…
  51Plan
• CVE-2023-38039When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.
  47Plan
• CVE-2024-2398HTTP/2 push headers memory-leak
  45Plan

Published before and after this one in the same product

• ← EarlierCVE-2020-8284Dec 14, 2020 · A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and…
  15Monitor
• ← EarlierCVE-2021-22897Jun 11, 2021 · curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST…
  22Monitor
• Later →CVE-2021-22922Aug 5, 2021 · When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML…
  27Monitor

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.