<p>Upgrade <code>Debian:12</code> <code>curl</code> to version 7.79.1-1 or higher.</p>

Improper Validation of Integrity Check Value Affecting curl package, versions <7.79.1-1

Threat Intelligence

0.35% (73^rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-DEBIAN12-CURL-1544048
published 22 Jul 2021
disclosed 5 Aug 2021

Report a new vulnerability Found a mistake?

Introduced: 22 Jul 2021

CVE-2021-22922 Open this link in a new tab CWE-354 Open this link in a new tab

How to fix?

Upgrade Debian:12 curl to version 7.79.1-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

References

CVSS Scores

version 3.1

Improper Validation of Integrity Check Value Affecting curl package, versions <7.79.1-1

Severity

Based on Debian security rating