CVE-2021-22898

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.(CVE-2021-22897)

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.(CVE-2021-22898)

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)

• curl: TELNET stack contents disclosure (CVE-2021-22898)

• curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)

• curl: TELNET stack contents disclosure (CVE-2021-22898)

• curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• check sscanf() for correct number of matches (CVE-2021-22898)

• SECURITY UPDATE: TELNET stack contents disclosure
  • debian/patches/CVE-2021-22898.patch: check sscanf() for correct number of matches in lib/telnet.c
  • CVE-2021-22898

• CVE-2021-22925: fix TELNET stack contents disclosure again
• CVE-2021-22898: fix TELNET stack contents disclosure
• CVE-2021-22876: prevent automatic referer from leaking credentials

curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers.

Due to flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol.

This could happen because curl did not check the return code from a sscanf(command, "%127[^,],%127s") function invoke correctly, and would leave the piece of the send buffer uninitialized for the value part if it was provided longer than 127 bytes. The buffer used for this is 2048 bytes big and the variable part of the variable=content pairs would be stored correctly in the send buffer, making curl sending "interleaved" bytes sequences of stack contents. A single curl TELNET handshake could then be made to send off a total of around 1800 bytes of (non-contiguous) stack contents in this style:

[control byte]name[control byte]
stack contents
[control byte]name[control byte]
stack contents
...

An easy proof of concept command line looks like this:

curl telnet://example.com -tNEW_ENV=a,bbbbbb (256 'b's)

TELNET stack contents disclosure (CVE-2021-22898).

This update for curl fixes the following issues:

• CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).
• Allow partial chain verification [jsc#SLE-17956]
  • Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA certificates are. This allows users to verify servers using the intermediate cert only, instead of needing the whole chain.
  • Set FLAG_TRUSTED_FIRST unconditionally.
  • Do not check partial chains with CRL check.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for curl fixes the following issues:

• CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).
• Allow partial chain verification [jsc#SLE-17956]
  • Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA certificates are. This allows users to verify servers using the intermediate cert only, instead of needing the whole chain.
  • Set FLAG_TRUSTED_FIRST unconditionally.
  • Do not check partial chains with CRL check.

These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

• CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).

This update for curl fixes the following issues:

• CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).

This update for curl fixes the following issues:

• CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).
• Allow partial chain verification [jsc#SLE-17956]
  • Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA certificates are. This allows users to verify servers using the intermediate cert only, instead of needing the whole chain.
  • Set FLAG_TRUSTED_FIRST unconditionally.
  • Do not check partial chains with CRL check.

This update for curl fixes the following issues:

• CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).
• Allow partial chain verification [jsc#SLE-17956]
  • Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA certificates are. This allows users to verify servers using the intermediate cert only, instead of needing the whole chain.
  • Set FLAG_TRUSTED_FIRST unconditionally.
  • Do not check partial chains with CRL check.

This update for curl fixes the following issues:

• CVE-2021-22898: TELNET stack contents disclosure (bsc#1186114)
• CVE-2021-22876: The automatic referer leaks credentials (bsc#1183933)
• CVE-2020-8286: Inferior OCSP verification (bsc#1179593)
• CVE-2020-8285: FTP wildcard stack overflow (bsc#1179399)
• CVE-2020-8284: Trusting FTP PASV responses (bsc#1179398)
• CVE-2020-8231: libcurl will pick and use the wrong connection with multiple requests with libcurl's multi API and the 'CURLOPT_CONNECT_ONLY' option (bsc#1175109)
• Fix: SFTP uploads result in empty uploaded files (bsc#1177976)

This update for curl fixes the following issues:

• CVE-2021-22876: Fixed an issue where the automatic referer was leaking credentials (bsc#1183933).
• CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).
• Fix for SFTP uploads when it results in empty uploaded files (bsc#1177976).
• Allow partial chain verification (jsc#SLE-17956).

Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t option was used on the command line. Uninitialized data possibly containing sensitive information could be sent to the remote server, contrary to expectations. (CVE-2021-22898, CVE-2021-22925)

Harry Sintonen discovered that curl incorrectly reused connections in the connection pool. This could result in curl reusing the wrong connections. (CVE-2021-22924)

USN-5021-1 fixed vulnerabilities in curl. This update provides the corresponding updates for Ubuntu 16.04 ESM.

Original advisory details:

Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t option was used on the command line. Uninitialized data possibly containing sensitive information could be sent to the remote server, contrary to expectations. (CVE-2021-22898, CVE-2021-22925)

Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t option was used on the command line. Uninitialized data possibly containing sensitive information could be sent to the remote server, contrary to expectations. This issue was only fixed in Ubuntu 14.04 ESM. (CVE-2021-22898, CVE-2021-22925)

It was discovered that curl incorrectly handled denials when using HTTP proxies. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-43552)