What’s Vulnerable › Vulnerabilities

CVE-2021-22897

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-11 · updated 2026-10-14
• Weakness: CWE-840

Description

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

Affected products

• curl: from 7.61.0 through 7.76.1
• NetApp Cloud Backup: all versions
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Hci Compute Node Firmware: all versions
• NetApp Solidfire, Enterprise Sds & Hci Storage Node: all versions
• NetApp Solidfire & Hci Management Node: all versions
• NetApp Solidfire Baseboard Management Controller Firmware: all versions
• Oracle Communications Cloud Native Core Binding Support Function: 1.11.0
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0
• Oracle Communications Cloud Native Core Network Repository Function: 1.15.0, 1.15.1
• Oracle Communications Cloud Native Core Network Slice Selection Function: 1.8.0
• Oracle Communications Cloud Native Core Service Communication Proxy: 1.15.0
• Oracle Corporation Oracle Essbase: before 11.1.2.4.047; from 21.0 before 21.3 — fixed in 11.1.2.4.047, 21.3
• MySQL Server: through 5.7.34; from 8.0.0 through 8.0.25
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
• Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6

How to fix

Upgrade to a fixed version: Oracle Corporation Oracle Essbase 11.1.2.4.047, 21.3; Siemens Sinec Infrastructure Network Services 1.0.1.1; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://curl.se/docs/CVE-2021-22897.html
• https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511
• https://hackerone.com/reports/1172857
• https://security.netapp.com/advisory/ntap-20210727-0007/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://curl.se/docs/CVE-2021-22897.html
• https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511
• https://hackerone.com/reports/1172857

Get alerted when CVE-2021-22897 or the next vulnerability affects your stack