CVE-2021-22923: Medium severity curl vulnerability
A flaw was found in curl in the way curl handles credentials when downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to gain access to credentials provided while downloading content without the user's knowledge. The highest threat from this vulnerability is to confidentiality.
Other sources
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-22923?
CVE-2021-22923 is a vulnerability that allows credentials to be passed to servers when using the metalink feature in curl.
Which software is affected by CVE-2021-22923?
The affected software includes Red Hat curl versions up to exclusive 7.78.0, Red Hat curl el8_4 versions up to exclusive 0:7.61.1-18.el8_4.1, and Red Hat curl el8_2 versions up to exclusive 0:7.61.1-12.el8_2. It also affects Haxx Curl versions between 7.27.0 to 7.78.0, Fedora versions 33, Netapp Cloud Backup, NetApp Clustered Data ONTAP, Netapp Hci Management Node, Netapp Solidfire, Oracle MySQL Server versions between 5.7.0 to 5.7.35 and between 8.0.0 to 8.0.26, Siemens Sinec Infrastructure Network Services up to exclusive 1.0.1.1, Apple macOS Ventura, Apple macOS Big Sur, Apple macOS Monterey, Netapp H300e Firmware, Netapp H500e Firmware, Netapp H700e Firmware, and Netapp h700e Firmware.
What is the severity rating of CVE-2021-22923?
CVE-2021-22923 has a severity rating of medium with a CVSS score of 5.7.
How can I fix CVE-2021-22923?
To fix CVE-2021-22923, you should update to the latest version of curl that includes the fix, which is version 7.78.0 or later.
Where can I find more information about CVE-2021-22923?
You can find more information about CVE-2021-22923 in the following references: [GitHub Commit](https://github.com/curl/curl/commit/b5fdbe848bc3d), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1984326), [curl.se](https://curl.se/docs/CVE-2021-22923.html)