Homepage

Exposure of Resource to Wrong Sphere The advisory has been revoked - it doesn't affect any version of package curl  (opens in a new tab)

Threat Intelligence

EPSS
4.27% (91st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-CURL-1296891
  • published26 May 2021
  • disclosed11 Jun 2021
Report a new vulnerability Found a mistake?

Introduced: 26 May 2021

CVE-2021-22897  (opens in a new tab)
CWE-668  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:unstable.

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian.

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.