{"id":"CVE-2021-22947","aliases":["ALPINE-CVE-2021-22947","AZL-6366","BELL-CVE-2021-22947","CLSA-2021-1635459163","CURL-CVE-2021-22947","DEBIAN-CVE-2021-22947","DLA-2773-1","DLA-3085-1","DSA-5197-1","EUVD-2021-10075","GHSA-94jh-wwgf-cmmc","JLSEC-2026-1340","MGASA-2021-0438","OESA-2021-1382","RHSA-2021:4059","RHSA-2022:0635","RHSA-2022:1354","RLSA-2021:4059","SUSE-SU-2021:14807-1","SUSE-SU-2021:3297-1","SUSE-SU-2021:3298-1","SUSE-SU-2021:3332-1","SUSE-SU-2021:3351-1","UBUNTU-CVE-2021-22947","USN-5079-1","USN-5079-2","openSUSE-SU-2021:1384-1","openSUSE-SU-2021:3298-1","openSUSE-SU-2024:10582-1"],"status":"published","title":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using...","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03009,"percentile":0.87513,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310","CWE-345"],"published":"2021-09-15T00:00:00Z","modified":"2026-10-25T01:04:42Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.79.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["7.82.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.79.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.79.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.79.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["7.81.0+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.20+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.19+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"curl","fixed_in":["7.74.0-1.3ubuntu2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.79.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.82.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-gnutls-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-nss-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-openssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-5+deb9u16"}]}],"versions":["7.52.1-5","7.52.1-5+deb9u1","7.52.1-5+deb9u10","7.52.1-5+deb9u11","7.52.1-5+deb9u12","7.52.1-5+deb9u13","7.52.1-5+deb9u14","7.52.1-5+deb9u15","7.52.1-5+deb9u2","7.52.1-5+deb9u3","7.52.1-5+deb9u4","7.52.1-5+deb9u5","7.52.1-5+deb9u6","7.52.1-5+deb9u7","7.52.1-5+deb9u8","7.52.1-5+deb9u9"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u3"}]}],"versions":["7.64.0-4","7.64.0-4+deb10u1","7.64.0-4+deb10u2"],"bundled":10},{"source":"osv","ecosystem":"Debian:11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u2"}]}],"versions":["7.74.0-1.3","7.74.0-1.3+deb11u1"],"bundled":15},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.81.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.4.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-11.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-11.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.74.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm8"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm1"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.15"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.7"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3ubuntu2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.15"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.7"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm8"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm1"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1.1"}]}],"bundled":48}],"products":[{"vendor":"apple","product":"macos"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"h300e_firmware"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500e_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700e_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"solidfire_baseboard_management_controller_firmware"},{"vendor":"oracle","product":"commerce_guided_search"},{"vendor":"oracle","product":"communications_cloud_native_core_binding_support_function"},{"vendor":"oracle","product":"communications_cloud_native_core_console"},{"vendor":"oracle","product":"communications_cloud_native_core_network_function_cloud_native_environment"},{"vendor":"oracle","product":"communications_cloud_native_core_network_repository_function"},{"vendor":"oracle","product":"communications_cloud_native_core_network_slice_selection_function"},{"vendor":"oracle","product":"communications_cloud_native_core_security_edge_protection_proxy"},{"vendor":"oracle","product":"communications_cloud_native_core_service_communication_proxy"},{"vendor":"oracle","product":"mysql_server"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1334763","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20211029-0003/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Mar/29","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://support.apple.com/kb/HT213183","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.debian.org/security/2022/dsa-5197","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202212-01","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-389290.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22947","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211029-0003"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD"},{"url":"https://github.com/advisories/GHSA-94jh-wwgf-cmmc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-22947","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-22947","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635459163","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-22947","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0438.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29461","tags":["report"]},{"url":"https://curl.se/docs/CVE-2021-22945.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22946.html","tags":["advisory","article"]},{"url":"https://curl.se/docs/CVE-2021-22947.html","tags":["advisory","article","report"]},{"url":"https://ubuntu.com/security/notices/USN-5079-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/J64OFB3I6OV4T3FD3PVSPTCKGUJCXUXX/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22945","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4059","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003191","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4059.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22946","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22947","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22947","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0635","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0635.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1354","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1981460","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1354.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22876","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22924","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22924","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22924.html","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4059","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114807-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190373","tags":["report"]},{"url":"https://bugzilla.suse.com/1190374","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22947","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213297-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213298-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213332-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213351-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22947","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5079-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5079-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5079-4","tags":["advisory"]},{"url":"https://launchpad.net/bugs/1944120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-22945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-22946","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YRVRDNRDONYRGYKCIS6D72VODPDQT3AB/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ROJISG4GC22MLBYTQB5THWN4V2IFZC7P/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22945","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-22947","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","status":"published","published":"2021-09-29T00:00:00Z","modified":"2026-10-14T11:34:51.272Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-10075","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","status":"published","published":"2021-09-29T00:00:00Z","modified":"2026-10-14T11:34:51Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:16.356399Z"}],"ghsa":[{"id":"GHSA-94jh-wwgf-cmmc","title":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using...","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","status":"published","published":"2022-05-24T19:16:02Z","modified":"2026-10-14T12:31:23Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:13:24.188405Z"}],"nvd":[{"id":"CVE-2021-22947","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","status":"published","published":"2021-09-29T20:15:08.253Z","modified":"2026-10-14T12:17:09.21Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310","CWE-345"],"updated_at":"2026-11-02T14:06:59.314106Z"}],"osv":[{"id":"ALPINE-CVE-2021-22947","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","status":"published","published":"2021-09-29T20:15:08.253Z","modified":"2026-10-23T17:17:56.154768044Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-6366","title":"CVE-2021-22947 affecting package curl for versions less than 7.82.0-1","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","status":"published","published":"2021-09-29T20:15:08Z","modified":"2026-04-21T04:32:11.492584Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2021-22947","title":"CVE-2021-22947 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:44.738839Z","modified":"2026-01-26T09:45:48.428321Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-22947","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","status":"published","published":"2021-09-29T20:15:08.253Z","modified":"2026-10-24T10:30:38.31113709Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-22947","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","status":"published","published":"2021-09-29T20:15:08.253Z","modified":"2026-10-15T09:47:40.115597888Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"JLSEC-2026-1340","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","status":"published","published":"2026-08-17T13:15:13.4Z","modified":"2026-08-17T13:30:03.102610595Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2021-1382","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nWhen curl \u0026gt;= 7.20.0 and \u0026lt;= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker\u0026apos;s injected data comes from the TLS-protected server.(CVE-2021-22947)\r\n\r\nA user can tell curl \u0026gt;= 7.20.0 and \u0026lt;= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.(CVE-2021-22946)\r\n\r\nWhen sending data to an MQTT server, libcurl \u0026lt;= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.(CVE-2021-22945)","status":"published","published":"2021-10-15T11:04:39Z","modified":"2026-08-18T01:16:03.854619515Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4059","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2024-09-16T06:35:57Z","modified":"2026-06-29T10:37:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2022:0635","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2024-09-16T06:36:04Z","modified":"2026-06-29T10:40:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1354","title":"Red Hat Security Advisory: rh-dotnet31-curl security update","status":"published","published":"2024-09-16T06:36:12Z","modified":"2026-09-21T10:03:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2021:4059","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols (CVE-2021-22946)\n\n* curl: Server responses received before STARTTLS processed after TLS handshake (CVE-2021-22947)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-11-02T07:49:01Z","modified":"2026-02-05T12:15:07.613014Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-22947","description":"When curl \u003e= 7.20.0 and \u003c= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.","status":"published","published":"2021-09-15T00:00:00Z","modified":"2026-04-27T09:14:17.89014Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"CLSA-2021-1635459163","title":"Fix CVE(s): CVE-2021-22946, CVE-2021-22947","description":"\n   * SECURITY UPDATE: Protocol downgrade required TLS bypassed\n     - debian/patches/CVE-2021-22946-pre1.patch: separate FTPS from FTP over\n       HTTPS proxy in lib/ftp.c, lib/urldata.h.\n     - debian/patches/CVE-2021-22946-pre2.patch: support PREAUTH response code\n       in lib/imap.c, lib/imap.h, tests/data/Makefile.inc, tests/data/test846.\n     - debian/patches/CVE-2021-22946.patch: do not ignore --ssl-reqd in\n       lib/ftp.c, lib/imap.c, lib/pop3.c, tests/data/Makefile.inc,\n       tests/data/test984, tests/data/test985, tests/data/test986.\n     - CVE-2021-22946\n   * SECURITY UPDATE: STARTTLS protocol injection via MITM\n     - debian/patches/CVE-2021-22947.patch: reject STARTTLS server response\n       pipelining in lib/ftp.c, lib/imap.c, lib/pop3.c, lib/smtp.c,\n       tests/data/Makefile.inc, tests/data/test980, tests/data/test981,\n       tests/data/test982, tests/data/test983.\n     - CVE-2021-22947","status":"published","published":"2021-10-28T22:12:43Z","modified":"2026-06-04T10:03:13.853818Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CURL-CVE-2021-22947","title":"STARTTLS protocol injection via MITM","description":"When curl connects to an IMAP, POP3, SMTP or FTP server to exchange data\nsecurely using STARTTLS to upgrade the connection to TLS level, the server can\nstill respond and send back multiple responses before the TLS upgrade. Such\nmultiple *pipelined* responses are cached by curl. curl would then upgrade to\nTLS but not flush the in-queue of cached responses and instead use and trust\nthe responses it got *before* the TLS handshake as if they were authenticated.\n\nUsing this flaw, it allows a Man-In-The-Middle attacker to first inject the\nfake responses, then pass-through the TLS traffic from the legitimate server\nand trick curl into sending data back to the user thinking the attacker's\ninjected data comes from the TLS-protected server.\n\nOver POP3 and IMAP an attacker can inject fake response data.","status":"published","published":"2021-09-15T08:00:00Z","modified":"2026-10-25T01:04:42.126610731Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"DLA-2773-1","title":"curl - security update","status":"published","published":"2021-09-30T00:00:00Z","modified":"2026-03-09T01:20:07.917232Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3085-1","title":"curl - security update","status":"published","published":"2022-08-29T00:00:00Z","modified":"2026-03-09T01:19:31.270449Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5197-1","title":"curl - security update","status":"published","published":"2022-08-01T00:00:00Z","modified":"2026-03-09T02:10:41.680987Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2021-0438","title":"Updated curl packages fix security vulnerability","description":"UAF and double-free in MQTT sending. (CVE-2021-22945)\n\nProtocol downgrade required TLS bypassed. (CVE-2021-22946)\n\nSTARTTLS protocol injection via MITM. (CVE-2021-22947)\n","status":"published","published":"2021-09-23T04:49:29Z","modified":"2026-04-16T04:44:40.416463587Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1384-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374).\n- CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-10-18T16:05:44Z","modified":"2026-02-04T03:18:51.755632Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3298-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374).\n- CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373).\n","status":"published","published":"2021-10-06T14:55:13Z","modified":"2026-02-04T02:59:20.266649Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10582-1","title":"curl-7.79.1-1.1 on GA media","description":"These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:36.472951Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:14807-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374).\n- CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373).\n","status":"published","published":"2021-09-23T14:20:40Z","modified":"2026-02-04T03:58:34.08629Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:3297-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374).\n- CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373).\n","status":"published","published":"2021-10-06T14:53:56Z","modified":"2026-02-04T02:25:10.744227Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3298-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374).\n- CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373).\n","status":"published","published":"2021-10-06T14:55:27Z","modified":"2026-02-04T04:06:33.203252Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3332-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n\n- CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374).\n- CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373).\n","status":"published","published":"2021-10-11T15:02:43Z","modified":"2026-02-04T03:57:05.543596Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3351-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374).\n- CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373).\n","status":"published","published":"2021-10-12T11:23:02Z","modified":"2026-02-04T04:31:28.11695Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5079-1","title":"curl vulnerabilities","description":"It was discovered that curl incorrect handled memory when sending data to\nan MQTT server. A remote attacker could use this issue to cause curl to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2021-22945)\n\nPatrick Monnerat discovered that curl incorrectly handled upgrades to TLS.\nWhen receiving certain responses from servers, curl would continue without\nTLS even when the option to require a successful upgrade to TLS was\nspecified. (CVE-2021-22946)\n\nPatrick Monnerat discovered that curl incorrectly handled responses\nreceived before STARTTLS. A remote attacker could possibly use this issue\nto inject responses and intercept communications. (CVE-2021-22947)\n","status":"published","published":"2021-09-15T11:11:13Z","modified":"2026-04-27T09:19:03.013268Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5079-2","title":"curl vulnerabilities","description":"USN-5079-1 fixed several vulnerabilities in curl. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n Patrick Monnerat discovered that curl incorrectly handled upgrades to TLS.\n When receiving certain responses from servers, curl would continue without\n TLS even when the option to require a successful upgrade to TLS was\n specified. (CVE-2021-22946)\n \n Patrick Monnerat discovered that curl incorrectly handled responses\n received before STARTTLS. A remote attacker could possibly use this issue\n to inject responses and intercept communications. (CVE-2021-22947)\n","status":"published","published":"2021-09-15T12:34:55Z","modified":"2026-06-29T13:49:31.678206683Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}