CVE-2021-22898: Infoleak
A flaw was found in the way curl handled telnet protocol option for sending environment variables, which could lead to sending of uninitialized data from a stack-based buffer to the server. This issue leads to potentially revealing sensitive internal information to the server using a clear-text network protocol.
Other sources
A vulnerability was found in curl where, due to flaw in the option parser for sending NEWENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol.
— Red Hat
curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPTTELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEWENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a flaw in the option parser for sending NEWENV variables. By sending a specially-crafted request using a clear-text network protocol, an attacker could exploit this vulnerability to obtain sensitive internal information to the server, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 0:7.61.1-22.el8 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.64.0-4+deb10u7Fixed in 7.74.0-1.3+deb11u9Fixed in 7.74.0-1.3+deb11u10Fixed in 7.88.1-10+deb12u3Fixed in 7.88.1-10+deb12u4Fixed in 8.4.0-2 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.77.0 - Configuration
If TELNET is used, ensure that no environment variable set via the NEW_ENV option has a name or value longer than 127 bytes.
curl/libcurl TELNET NEW_ENV NEW_ENV variable name and value length = 127 bytes or less - Configuration
Do not set TELNET options for the curl command-line tool or libcurl when the TELNET protocol is not intended to be used.
curl/libcurl TELNET options -t/--telnet-option or CURLOPT_TELNETOPTIONS = disabled when TELNET is not used
Event History
Frequently Asked Questions
What is CVE-2021-22898?
CVE-2021-22898 is a vulnerability in the curl library that allows for information disclosure when using the `-t` command line option.
What is the severity of CVE-2021-22898?
CVE-2021-22898 has a severity rating of 7.5 (high).
Which software versions are affected by CVE-2021-22898?
CVE-2021-22898 affects curl versions 7.7 through 7.76.1.
How can I fix CVE-2021-22898?
To fix CVE-2021-22898, update curl to version 7.88.1-11 or higher.
Is there any additional information available for CVE-2021-22898?
Yes, you can find additional information about CVE-2021-22898 in the references provided.