Missing Initialization of Resource Affecting curl package, versions <7.74.0-1.3+deb11u2
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-CURL-1296884
- published 26 May 2021
- disclosed 11 Jun 2021
Introduced: 26 May 2021
CVE-2021-22898 Open this link in a new tabHow to fix?
Upgrade Debian:11 curl to version 7.74.0-1.3+deb11u2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian:11.
See How to fix? for Debian:11 relevant fixed versions and status.
curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.