What’s Vulnerable › Vulnerabilities

CVE-2021-22925

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-05 · updated 2026-10-14
• Weakness: CWE-200

Description

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

Affected products

• macOS: 10.15.7, 10.15.7-security_update_2021-001, 10.15.7-security_update_2021-002, 10.15.7-security_update_2021-003, 10.15.7-security_update_2021-004
• Apple macOS: 11.0, 11.0.1, 11.1, 11.1.0, 11.2, 11.2.1 (+4)
• Fedoraproject Fedora: 33
• curl: from 7.7 before 7.78.0 — fixed in 7.78.0
• NetApp Cloud Backup: all versions
• Clustered Data ONTAP: all versions
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Hci Management Node: all versions
• NetApp Solidfire: all versions
• MySQL Server: from 5.7.0 through 5.7.35; from 8.0.0 through 8.0.26
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.57, 8.58, 8.59
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
• Siemens SINEMA Remote Connect Server: before 3.1 — fixed in 3.1
• Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6

How to fix

Upgrade to a fixed version: curl 7.78.0; Siemens Sinec Infrastructure Network Services 1.0.1.1; Siemens SINEMA Remote Connect Server 3.1; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2021/Sep/39
• http://seclists.org/fulldisclosure/2021/Sep/40
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://hackerone.com/reports/1223882
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20210902-0003/
• https://support.apple.com/kb/HT212804
• https://support.apple.com/kb/HT212805
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Get alerted when CVE-2021-22925 or the next vulnerability affects your stack