Your submission was sent successfully! Close

Thank you for contacting us. A member of our team will be in touch shortly. Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2021-22924

Publication date 21 July 2021

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

3.7 · Low

Score breakdown

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Read the notes from the security team

Status

Package Ubuntu Release Status
curl 23.04 lunar
Fixed 7.74.0-1.2ubuntu4
22.10 kinetic
Fixed 7.74.0-1.2ubuntu4
22.04 LTS jammy
Fixed 7.74.0-1.2ubuntu4
21.10 impish
Fixed 7.74.0-1.2ubuntu4
21.04 hirsute
Fixed 7.74.0-1ubuntu2.1
20.10 groovy Ignored end of life
20.04 LTS focal
Fixed 7.68.0-1ubuntu2.6
18.04 LTS bionic
Fixed 7.58.0-2ubuntu3.14
16.04 LTS xenial Ignored changes too intrusive
14.04 LTS trusty Ignored changes too intrusive

Notes

mdeslaur

introduced in 7.10.4

rodrigo-zaiden

although the issue was introduced in 7.10.4, versions earlier than 7.52.0 would need at least parts of commit cb4e2be7 so the fix for this CVE can be applied. this change seems quite intrusive and there is a high risk of regressions. hence, versions earlier than 7.52 will be ignored.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
curl

Severity score breakdown

Parameter Value
Base score 3.7 · Low
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Related Ubuntu Security Notices (USN)

Other references