What’s Vulnerable › Vulnerabilities

CVE-2021-22924

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-05 · updated 2026-10-14
• Weakness: CWE-20

Description

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Affected products

• Debian Linux: 9.0, 10.0, 11.0
• Fedoraproject Fedora: 33
• curl: from 7.10.4 before 7.77.0 — fixed in 7.77.0
• NetApp Cloud Backup: all versions
• Clustered Data ONTAP: all versions
• NetApp Solidfire & Hci Management Node: all versions
• NetApp Solidfire Baseboard Management Controller Firmware: all versions
• MySQL Server: from 5.7.0 through 5.7.36; from 8.0.0 through 8.0.26
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.57, 8.58, 8.59
• Siemens Logo! Cmr2020 Firmware: all versions
• Siemens Logo! Cmr2040 Firmware: all versions
• Siemens Ruggedcomrm 1224 Lte Firmware: before 7.1 — fixed in 7.1
• Siemens Scalance M804Pb Firmware: before 7.1 — fixed in 7.1
• Siemens Scalance M812-1 Firmware: before 7.1 — fixed in 7.1
• Siemens Scalance M816-1 Firmware: before 7.1 — fixed in 7.1
• Siemens Scalance M826-2 Firmware: before 7.1 — fixed in 7.1
• Siemens Scalance M874-2 Firmware: before 7.1 — fixed in 7.1
• Siemens Scalance M874-3 Firmware: before 7.1 — fixed in 7.1
• Siemens Scalance M876-3 Firmware: before 7.1 — fixed in 7.1
• Siemens Scalance M876-4 Firmware: before 7.1 — fixed in 7.1
• Siemens Scalance Mum856-1 Firmware: before 7.1 — fixed in 7.1
• Siemens Scalance S615 Firmware: before 7.1 — fixed in 7.1
• Siemens SIMATIC CP 1543-1 V4.0: before 3.0.22 — fixed in 3.0.22
• Siemens Simatic Cp 1545-1 Firmware: before 1.1 — fixed in 1.1
• Siemens Simatic Rtu3010C Firmware: before 5.0.14 — fixed in 5.0.14
• Siemens Simatic Rtu3030C Firmware: before 5.0.14 — fixed in 5.0.14
• Siemens Simatic Rtu3031C Firmware: before 5.0.14 — fixed in 5.0.14
• Siemens Simatic Rtu 3041C Firmware: before 5.0.14 — fixed in 5.0.14
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
• Siemens SINEMA Remote Connect: before 3.1 — fixed in 3.1

How to fix

Upgrade to a fixed version: curl 7.77.0; Siemens Ruggedcomrm 1224 Lte Firmware 7.1; Siemens Scalance M804Pb Firmware 7.1; Siemens Scalance M812-1 Firmware 7.1; Siemens Scalance M816-1 Firmware 7.1; Siemens Scalance M826-2 Firmware 7.1; Siemens Scalance M874-2 Firmware 7.1; Siemens Scalance M874-3 Firmware 7.1; Siemens Scalance M876-3 Firmware 7.1; Siemens Scalance M876-4 Firmware 7.1; Siemens Scalance Mum856-1 Firmware 7.1; Siemens Scalance S615 Firmware 7.1. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf
• https://hackerone.com/reports/1223565
• https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
• https://security.netapp.com/advisory/ntap-20210902-0003/

Get alerted when CVE-2021-22924 or the next vulnerability affects your stack