{"id":"CVE-2021-22898","aliases":["ALPINE-CVE-2021-22898","ALSA-2021:4511","AZL-6359","BELL-CVE-2021-22898","CLSA-2021-1632261872","CLSA-2021-1635459182","CLSA-2022-1643198583","CURL-CVE-2021-22898","DEBIAN-CVE-2021-22898","DLA-2734-1","DLA-3085-1","DSA-5197-1","EUVD-2021-10030","GHSA-7w8r-q58w-5wcr","JLSEC-2026-1334","MGASA-2021-0243","OESA-2021-1216","RHSA-2021:4511","RLSA-2021:4511","SUSE-SU-2021:14735-1","SUSE-SU-2021:14760-1","SUSE-SU-2021:1762-1","SUSE-SU-2021:1763-1","SUSE-SU-2021:1786-1","SUSE-SU-2021:1809-1","UBUNTU-CVE-2021-22898","USN-5021-1","USN-5021-2","USN-5894-1","openSUSE-SU-2021:0808-1","openSUSE-SU-2021:1762-1","openSUSE-SU-2024:10582-1"],"status":"published","title":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option,...","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.04507,"percentile":0.9164,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-909"],"published":"2021-05-26T06:00:00Z","modified":"2026-10-29T11:01:42Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"curl","fixed_in":["7.66.0-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"curl","fixed_in":["7.67.0-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.77.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["7.76.0-5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"curl","fixed_in":["7.19.7-57.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"libcurl","fixed_in":["7.19.7-57.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"libcurl-devel","fixed_in":["7.19.7-57.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"curl","fixed_in":["7.47.0-1ubuntu2.20"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3","fixed_in":["7.47.0-1ubuntu2.20"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-gnutls","fixed_in":["7.47.0-1ubuntu2.20"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-nss","fixed_in":["7.47.0-1ubuntu2.20"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-doc","fixed_in":["7.47.0-1ubuntu2.20"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-gnutls-dev","fixed_in":["7.47.0-1ubuntu2.20"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-nss-dev","fixed_in":["7.47.0-1ubuntu2.20"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-openssl-dev","fixed_in":["7.47.0-1ubuntu2.20"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.79.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.79.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.79.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["7.81.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"curl","fixed_in":["7.71.0-1.3.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"curl","fixed_in":["7.74.0-1.2.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","fixed_in":["7.37.0-70.63.1","7.37.0-70.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"curl","fixed_in":["7.37.0-70.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"curl","fixed_in":["7.37.0-70.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"curl","fixed_in":["7.66.0-4.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"curl","fixed_in":["7.66.0-4.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"curl","fixed_in":["7.66.0-4.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","fixed_in":["7.60.0-11.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","fixed_in":["7.60.0-11.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","fixed_in":["7.60.0-11.18.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.20+esm14"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.19+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.6"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"curl","fixed_in":["7.66.0-lp152.3.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"curl-mini","fixed_in":["7.66.0-lp152.3.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"curl","fixed_in":["7.66.0-4.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"curl-mini","fixed_in":["7.66.0-4.17.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.66.0-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.67.0-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.77.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-57.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-57.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-57.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.20"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.20"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.20"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.20"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.20"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-gnutls-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.20"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-nss-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.20"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-openssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.20"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-5+deb9u15"}]}],"versions":["7.52.1-5","7.52.1-5+deb9u1","7.52.1-5+deb9u10","7.52.1-5+deb9u11","7.52.1-5+deb9u12","7.52.1-5+deb9u13","7.52.1-5+deb9u14","7.52.1-5+deb9u2","7.52.1-5+deb9u3","7.52.1-5+deb9u4","7.52.1-5+deb9u5","7.52.1-5+deb9u6","7.52.1-5+deb9u7","7.52.1-5+deb9u8","7.52.1-5+deb9u9"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u3"}]}],"versions":["7.64.0-4","7.64.0-4+deb10u1","7.64.0-4+deb10u2"],"bundled":10},{"source":"osv","ecosystem":"Debian:11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u2"}]}],"versions":["7.74.0-1.3","7.74.0-1.3+deb11u1"],"bundled":15},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.81.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.0-1.3.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.2.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-7.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.63.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm14"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm3"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.14"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.6"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.14"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.6"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm3"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm14"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm7"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2","7.47.0-1ubuntu2.19+esm3","7.47.0-1ubuntu2.19+esm4","7.47.0-1ubuntu2.19+esm5","7.47.0-1ubuntu2.19+esm6"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1.1"}]}],"bundled":48}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"haxx","product":"curl"},{"vendor":"oracle","product":"communications_cloud_native_core_binding_support_function"},{"vendor":"oracle","product":"communications_cloud_native_core_network_function_cloud_native_environment"},{"vendor":"oracle","product":"communications_cloud_native_core_network_repository_function"},{"vendor":"oracle","product":"communications_cloud_native_core_network_slice_selection_function"},{"vendor":"oracle","product":"communications_cloud_native_core_service_communication_proxy"},{"vendor":"oracle","product":"essbase"},{"vendor":"oracle","product":"mysql_server"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1176461","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://curl.se/docs/CVE-2021-22898.html","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Vendor Advisory","fix","web","advisory","article","report"]},{"url":"https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/07/21/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.debian.org/security/2022/dsa-5197","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22898","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V"},{"url":"https://github.com/advisories/GHSA-7w8r-q58w-5wcr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-22898","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-4511.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-22876","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22898","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22925","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-22898","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2021-1632261872.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635459182","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1643198583.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-22898","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0243.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28971","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BQBFQI6AGHALKDLOL5S4ST4RMK2YG5SG/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1216","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22897","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4511","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970902","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4511.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22876","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22898","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22898","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22925","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22925","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4511","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114735-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186114","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22898","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114760-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211762-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211763-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211786-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175109","tags":["report"]},{"url":"https://bugzilla.suse.com/1177976","tags":["report"]},{"url":"https://bugzilla.suse.com/1179398","tags":["report"]},{"url":"https://bugzilla.suse.com/1179399","tags":["report"]},{"url":"https://bugzilla.suse.com/1179593","tags":["report"]},{"url":"https://bugzilla.suse.com/1183933","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22876","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211809-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22898","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5021-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5021-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5894-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-22925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-43552","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3ES6AKURDGLC4PDCDFLHOPWYDQA55NHQ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OBJDOC5P7XCTDSENHRNLNXYRSHFI4CYU/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22947","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-22898","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","status":"published","published":"2021-06-11T15:49:37Z","modified":"2026-10-14T10:21:16.555Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:58.028461Z"}],"euvd":[{"id":"EUVD-2021-10030","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","status":"published","published":"2021-06-11T15:49:37Z","modified":"2026-10-14T10:21:16Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:16.85534Z"}],"ghsa":[{"id":"GHSA-7w8r-q58w-5wcr","title":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option,...","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","status":"published","published":"2022-05-24T19:05:02Z","modified":"2026-10-14T12:32:24Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200","CWE-909"],"updated_at":"2026-11-02T15:13:24.812204Z"}],"nvd":[{"id":"CVE-2021-22898","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","status":"published","published":"2021-06-11T16:15:11.043Z","modified":"2026-10-14T11:16:52.873Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200","CWE-909"],"updated_at":"2026-11-02T14:06:54.439974Z"}],"osv":[{"id":"ALPINE-CVE-2021-22898","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","status":"published","published":"2021-06-11T16:15:11.043Z","modified":"2026-10-23T17:17:56.151132573Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-6359","title":"CVE-2021-22898 affecting package curl for versions less than 7.76.0-5","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","status":"published","published":"2021-06-11T16:15:11Z","modified":"2026-04-21T04:32:10.051451Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2021-22898","title":"CVE-2021-22898 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:36.304816Z","modified":"2026-01-26T09:49:34.143463Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-22898","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","status":"published","published":"2021-06-11T16:15:11.043Z","modified":"2026-10-24T14:25:07.618258883Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-22898","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","status":"published","published":"2021-06-11T16:15:11.043Z","modified":"2026-10-15T09:47:41.714314458Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"JLSEC-2026-1334","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending `NEW_ENV` variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","status":"published","published":"2026-08-17T13:15:13.4Z","modified":"2026-08-17T13:30:03.099571784Z","cvss":[{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2021-1216","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\ncurl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single \"static\" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.(CVE-2021-22897)\r\n\r\ncurl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.(CVE-2021-22898)","status":"published","published":"2021-06-12T11:04:27Z","modified":"2026-08-18T01:15:31.084693968Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4511","title":"Red Hat Security Advisory: curl security and bug fix update","status":"published","published":"2024-09-16T06:20:48Z","modified":"2026-09-21T10:03:10Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4511","title":"Moderate: curl security and bug fix update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)\n\n* curl: TELNET stack contents disclosure (CVE-2021-22898)\n\n* curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:38:13Z","modified":"2026-02-04T22:15:08.810995Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-22898","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.","status":"published","published":"2021-05-26T06:00:00Z","modified":"2026-04-27T09:13:57.040849Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"ALSA-2021:4511","title":"Moderate: curl security and bug fix update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)\n\n* curl: TELNET stack contents disclosure (CVE-2021-22898)\n\n* curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:38:13Z","modified":"2026-10-29T11:01:42.763436957Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2021-1632261872","title":"Fix of CVE: CVE-2021-22898","description":"- check sscanf() for correct number of matches (CVE-2021-22898)","status":"published","published":"2021-09-21T22:04:32Z","modified":"2026-06-01T00:30:10.971517309Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1635459182","title":"Fix CVE(s): CVE-2021-22898","description":"\n   * SECURITY UPDATE: TELNET stack contents disclosure\n     - debian/patches/CVE-2021-22898.patch: check sscanf() for correct number\n       of matches in lib/telnet.c\n     - CVE-2021-22898","status":"published","published":"2021-10-28T22:13:02Z","modified":"2026-06-04T10:03:22.347137Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1643198583","title":"Fix of CVE: CVE-2021-22876, CVE-2021-22898, CVE-2021-22925","description":"- CVE-2021-22925: fix TELNET stack contents disclosure again\n- CVE-2021-22898: fix TELNET stack contents disclosure\n- CVE-2021-22876: prevent automatic referer from leaking credentials","status":"published","published":"2022-01-26T12:03:03Z","modified":"2026-06-01T00:33:19.120530586Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CURL-CVE-2021-22898","title":"TELNET stack contents disclosure","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`\nin libcurl. This rarely used option is used to send variable=content pairs to\nTELNET servers.\n\nDue to flaw in the option parser for sending `NEW_ENV` variables, libcurl\ncould be made to pass on uninitialized data from a stack based buffer to the\nserver. Therefore potentially revealing sensitive internal information to the\nserver using a clear-text network protocol.\n\nThis could happen because curl did not check the return code from a\n`sscanf(command, \"%127[^,],%127s\")` function invoke correctly, and would leave\nthe piece of the send buffer uninitialized for the value part if it was\nprovided longer than 127 bytes. The buffer used for this is 2048 bytes big and\nthe *variable* part of the *variable=content* pairs would be stored correctly\nin the send buffer, making curl sending \"interleaved\" bytes sequences of stack\ncontents. A single curl TELNET handshake could then be made to send off a\ntotal of around 1800 bytes of (non-contiguous) stack contents in this style:\n\n    [control byte]name[control byte]\n    stack contents\n    [control byte]name[control byte]\n    stack contents\n    ...\n\nAn easy proof of concept command line looks like this:\n\n    curl telnet://example.com -tNEW_ENV=a,bbbbbb (256 'b's)","status":"published","published":"2021-05-26T08:00:00Z","modified":"2026-10-25T01:05:32.932233508Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"DLA-2734-1","title":"curl - security update","status":"published","published":"2021-08-09T00:00:00Z","modified":"2026-03-09T01:20:39.893245Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-3085-1","title":"curl - security update","status":"published","published":"2022-08-29T00:00:00Z","modified":"2026-03-09T01:19:31.270449Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5197-1","title":"curl - security update","status":"published","published":"2022-08-01T00:00:00Z","modified":"2026-03-09T02:10:41.680987Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2021-0243","title":"Updated curl packages fix a security vulnerability","description":"TELNET stack contents disclosure (CVE-2021-22898).\n","status":"published","published":"2021-06-08T21:45:12Z","modified":"2026-04-16T04:44:42.909318161Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0808-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).\n- Allow partial chain verification [jsc#SLE-17956]\n  * Have intermediate certificates in the trust store be treated\n    as trust-anchors, in the same way as self-signed root CA\n    certificates are. This allows users to verify servers using\n    the intermediate cert only, instead of needing the whole chain.\n  * Set FLAG_TRUSTED_FIRST unconditionally.\n  * Do not check partial chains with CRL check.\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-05-29T16:05:16Z","modified":"2025-05-07T18:12:30.971865Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1762-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).\n- Allow partial chain verification [jsc#SLE-17956]\n  * Have intermediate certificates in the trust store be treated\n    as trust-anchors, in the same way as self-signed root CA\n    certificates are. This allows users to verify servers using\n    the intermediate cert only, instead of needing the whole chain.\n  * Set FLAG_TRUSTED_FIRST unconditionally.\n  * Do not check partial chains with CRL check.\n","status":"published","published":"2021-07-10T16:41:42Z","modified":"2026-02-04T04:12:20.504712Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10582-1","title":"curl-7.79.1-1.1 on GA media","description":"These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:36.472951Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:14735-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).\n","status":"published","published":"2021-05-26T10:32:37Z","modified":"2025-05-02T04:31:08.823726Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:14760-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).\n","status":"published","published":"2021-06-30T15:15:05Z","modified":"2026-02-04T03:01:30.64212Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1762-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).\n- Allow partial chain verification [jsc#SLE-17956]\n  * Have intermediate certificates in the trust store be treated\n    as trust-anchors, in the same way as self-signed root CA\n    certificates are. This allows users to verify servers using\n    the intermediate cert only, instead of needing the whole chain.\n  * Set FLAG_TRUSTED_FIRST unconditionally.\n  * Do not check partial chains with CRL check.\n","status":"published","published":"2021-05-26T10:30:15Z","modified":"2026-02-04T03:50:12.433848Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1763-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).\n- Allow partial chain verification [jsc#SLE-17956]\n  * Have intermediate certificates in the trust store be treated\n    as trust-anchors, in the same way as self-signed root CA\n    certificates are. This allows users to verify servers using\n    the intermediate cert only, instead of needing the whole chain.\n  * Set FLAG_TRUSTED_FIRST unconditionally.\n  * Do not check partial chains with CRL check.\n","status":"published","published":"2021-05-26T10:32:05Z","modified":"2026-02-04T02:57:40.848684Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1786-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n- CVE-2021-22898: TELNET stack contents disclosure (bsc#1186114)\n- CVE-2021-22876: The automatic referer leaks credentials (bsc#1183933)\n- CVE-2020-8286: Inferior OCSP verification (bsc#1179593)\n- CVE-2020-8285: FTP wildcard stack overflow (bsc#1179399)\n- CVE-2020-8284: Trusting FTP PASV responses (bsc#1179398)\n- CVE-2020-8231: libcurl will pick and use the wrong connection with multiple requests with libcurl's multi API and the 'CURLOPT_CONNECT_ONLY' option (bsc#1175109)\n- Fix: SFTP uploads result in empty uploaded files (bsc#1177976)\n","status":"published","published":"2021-05-27T14:45:51Z","modified":"2026-02-04T04:18:37.030331Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1809-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22876: Fixed an issue where the automatic referer was leaking credentials (bsc#1183933).\n- CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).\n- Fix for SFTP uploads when it results in empty uploaded files (bsc#1177976).\n- Allow partial chain verification (jsc#SLE-17956).\n","status":"published","published":"2021-05-31T14:25:34Z","modified":"2025-05-02T04:31:08.149564Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-5021-1","title":"curl vulnerabilities","description":"Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled\nTELNET connections when the -t option was used on the command line.\nUninitialized data possibly containing sensitive information could be sent\nto the remote server, contrary to expectations. (CVE-2021-22898,\nCVE-2021-22925)\n\nHarry Sintonen discovered that curl incorrectly reused connections in the\nconnection pool. This could result in curl reusing the wrong connections.\n(CVE-2021-22924)\n","status":"published","published":"2021-07-22T18:17:55Z","modified":"2026-04-27T09:18:25.635931Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5021-2","title":"curl vulnerability","description":"USN-5021-1 fixed vulnerabilities in curl. This update provides\nthe corresponding updates for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled\n TELNET connections when the -t option was used on the command line.\n Uninitialized data possibly containing sensitive information could be sent\n to the remote server, contrary to expectations. (CVE-2021-22898,\n CVE-2021-22925)\n","status":"published","published":"2022-01-20T11:40:36Z","modified":"2026-06-25T13:30:41.010944234Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5894-1","title":"curl vulnerabilities","description":"Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled\nTELNET connections when the -t option was used on the command line.\nUninitialized data possibly containing sensitive information could be sent\nto the remote server, contrary to expectations. This issue was only fixed\nin Ubuntu 14.04 ESM. (CVE-2021-22898, CVE-2021-22925)\n\nIt was discovered that curl incorrectly handled denials when using HTTP\nproxies. A remote attacker could use this issue to cause curl to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2022-43552)\n","status":"published","published":"2023-02-27T14:10:27Z","modified":"2026-06-29T13:50:46.648994714Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}