CVE-2021-22890: Medium severity haxx libcurl vulnerability

Published Mar 23, 2021
·
Updated

A flaw was found in the way libcurl handled TLS 1.3 session tickets. A malicious HTTPS proxy could possibly use this flaw to make libcurl resume a TLS session it previously had with the proxy while intending to resume a TLS session with a target server, making it possible for the proxy to perform a man-in-the-middle attack.

Other sources

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed.

Upstream Advisory:

https://curl.se/docs/CVE-2021-22890.html

— Red Hat

Affected Software

34 affected componentsFixes available
redhat/jbcs-httpd24<0:1-18.el8
0:1-18.el8
redhat/jbcs-httpd24-apr<0:1.6.3-105.el8
0:1.6.3-105.el8
redhat/jbcs-httpd24-apr-util<0:1.6.1-82.el8
0:1.6.1-82.el8
redhat/jbcs-httpd24-brotli<0:1.0.6-40.el8
0:1.0.6-40.el8
redhat/jbcs-httpd24-curl<0:7.77.0-2.el8
0:7.77.0-2.el8
redhat/jbcs-httpd24-httpd<0:2.4.37-74.el8
0:2.4.37-74.el8
redhat/jbcs-httpd24-jansson<0:2.11-55.el8
0:2.11-55.el8
redhat/jbcs-httpd24-nghttp2<0:1.39.2-37.el8
0:1.39.2-37.el8
redhat/jbcs-httpd24-openssl<1:1.1.1g-6.el8
1:1.1.1g-6.el8
redhat/jbcs-httpd24-openssl-chil<0:1.0.0-5.el8
0:1.0.0-5.el8
redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-20.el8
0:0.4.10-20.el8
redhat/jbcs-httpd24<0:1-18.jbcs.el7
0:1-18.jbcs.el7
redhat/jbcs-httpd24-apr<0:1.6.3-105.jbcs.el7
0:1.6.3-105.jbcs.el7
redhat/jbcs-httpd24-apr-util<0:1.6.1-82.jbcs.el7
0:1.6.1-82.jbcs.el7
redhat/jbcs-httpd24-curl<0:7.77.0-2.jbcs.el7
0:7.77.0-2.jbcs.el7
redhat/jbcs-httpd24-httpd<0:2.4.37-74.jbcs.el7
0:2.4.37-74.jbcs.el7
redhat/jbcs-httpd24-jansson<0:2.11-55.jbcs.el7
0:2.11-55.jbcs.el7
debian/curl
7.64.0-4+deb10u27.64.0-4+deb10u77.74.0-1.3+deb11u97.74.0-1.3+deb11u107.88.1-10+deb12u37.88.1-10+deb12u48.4.0-2
redhat/curl<7.76.0
7.76.0
haxx libcurl>=7.63.0<=7.75.0
Fedoraproject Fedora=32
Fedoraproject Fedora=33
Fedoraproject Fedora=34
NetApp Hci Management Node
NetApp Solidfire
NetApp Hci Storage Node
Broadcom Fabric Operating System
Debian Debian Linux=9.0
Siemens Sinec Infrastructure Network Services<1.0.1.1
Oracle Communications Billing and Revenue Management=12.0.0.3.0
Oracle Essbase=21.2
Splunk Universal Forwarder>=8.2.0<8.2.12
Splunk Universal Forwarder>=9.0.0<9.0.6
Splunk Universal Forwarder=9.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/jbcs-httpd24 to a version that resolves this vulnerability.

    Fixed in 0:1-18.el8
  2. Upgrade

    Upgrade redhat/jbcs-httpd24-apr to a version that resolves this vulnerability.

    Fixed in 0:1.6.3-105.el8
  3. Upgrade

    Upgrade redhat/jbcs-httpd24-apr-util to a version that resolves this vulnerability.

    Fixed in 0:1.6.1-82.el8
  4. Upgrade

    Upgrade redhat/jbcs-httpd24-brotli to a version that resolves this vulnerability.

    Fixed in 0:1.0.6-40.el8
  5. Upgrade

    Upgrade redhat/jbcs-httpd24-curl to a version that resolves this vulnerability.

    Fixed in 0:7.77.0-2.el8
  6. Upgrade

    Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.

    Fixed in 0:2.4.37-74.el8
  7. Upgrade

    Upgrade redhat/jbcs-httpd24-jansson to a version that resolves this vulnerability.

    Fixed in 0:2.11-55.el8
  8. Upgrade

    Upgrade redhat/jbcs-httpd24-nghttp2 to a version that resolves this vulnerability.

    Fixed in 0:1.39.2-37.el8
  9. Upgrade

    Upgrade redhat/jbcs-httpd24-openssl to a version that resolves this vulnerability.

    Fixed in 1:1.1.1g-6.el8
  10. Upgrade

    Upgrade redhat/jbcs-httpd24-openssl-chil to a version that resolves this vulnerability.

    Fixed in 0:1.0.0-5.el8
  11. Upgrade

    Upgrade redhat/jbcs-httpd24-openssl-pkcs11 to a version that resolves this vulnerability.

    Fixed in 0:0.4.10-20.el8
  12. Upgrade

    Upgrade redhat/jbcs-httpd24 to a version that resolves this vulnerability.

    Fixed in 0:1-18.jbcs.el7
  13. Upgrade

    Upgrade redhat/jbcs-httpd24-apr to a version that resolves this vulnerability.

    Fixed in 0:1.6.3-105.jbcs.el7
  14. Upgrade

    Upgrade redhat/jbcs-httpd24-apr-util to a version that resolves this vulnerability.

    Fixed in 0:1.6.1-82.jbcs.el7
  15. Upgrade

    Upgrade redhat/jbcs-httpd24-curl to a version that resolves this vulnerability.

    Fixed in 0:7.77.0-2.jbcs.el7
  16. Upgrade

    Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.

    Fixed in 0:2.4.37-74.jbcs.el7
  17. Upgrade

    Upgrade redhat/jbcs-httpd24-jansson to a version that resolves this vulnerability.

    Fixed in 0:2.11-55.jbcs.el7
  18. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 7.64.0-4+deb10u2Fixed in 7.64.0-4+deb10u7Fixed in 7.74.0-1.3+deb11u9Fixed in 7.74.0-1.3+deb11u10Fixed in 7.88.1-10+deb12u3Fixed in 7.88.1-10+deb12u4Fixed in 8.4.0-2
  19. Upgrade

    Upgrade redhat/curl to a version that resolves this vulnerability.

    Fixed in 7.76.0

Event History

Mar 31, 2021
CVE Published
12:00 AM
Apr 1, 2021
CVE Published
via MITRE·05:46 PM
Data Sourced
via MITRE·05:46 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is CVE-2021-22890?

CVE-2021-22890 is a vulnerability in libcurl that allows a malicious HTTPS proxy to perform a Man-in-the-Middle attack on a connection.

2

Which versions of curl are affected by CVE-2021-22890?

curl versions 7.63.0 to 7.75.0 are affected by CVE-2021-22890.

3

How can a malicious HTTPS proxy exploit CVE-2021-22890?

A malicious HTTPS proxy can exploit CVE-2021-22890 by confusing session tickets and performing a Man-in-the-Middle attack on TLS 1.3 connections.

4

What is the severity of CVE-2021-22890?

CVE-2021-22890 has a severity value of 3.7, which is considered low.

5

Where can I find more information about CVE-2021-22890?

You can find more information about CVE-2021-22890 on the CVE website, NIST NVD, and the official curl documentation.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203