Aller au contenu
ForenShield – plateforme d’analyse forensique et cybersécuritéForenShield

Fiche vulnérabilité

CVE-2021-22946 : faille élevée haxx curl (CVSS 7.5)

Description

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

En bref

Sévérité
Élevée (CVSS 7.5)
Vecteur CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitation active
Non signalée par la CISA
Publication
29 sept. 2021
Dernière mise à jour
17 juin 2026

Produits concernés

  • haxx curl
  • debian debian linux
  • fedoraproject fedora
  • netapp cloud backup
  • netapp clustered data ontap
  • netapp oncommand insight
  • netapp oncommand workflow automation
  • netapp snapcenter
  • netapp h300s firmware
  • netapp h500s firmware
  • netapp h700s firmware
  • netapp h300e firmware
  • netapp h500e firmware
  • netapp h700e firmware
  • netapp h410s firmware
  • netapp solidfire baseboard management controller firmware
  • oracle communications cloud native core binding support function
  • oracle communications cloud native core network function cloud native environment
  • oracle communications cloud native core network repository function
  • oracle communications cloud native core network slice selection function

Références

Rechercher une autre vulnérabilité dans la base CVE