What’s Vulnerable › Vulnerabilities
CVE-2021-22946
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-09-29 · updated 2026-10-14
- Weakness: CWE-325
Description
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
Affected products
- Apple macOS: before 12.3 — fixed in 12.3
- Debian Linux: 9.0, 10.0, 11.0
- Fedoraproject Fedora: 33, 35
- curl: from 7.20.0 before 7.79.0 — fixed in 7.79.0
- NetApp Cloud Backup: all versions
- Clustered Data ONTAP: all versions
- NetApp H300E Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500E Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700E Firmware: all versions
- NetApp H700S Firmware: all versions
- OnCommand Insight: all versions
- NetApp OnCommand Workflow Automation: all versions
- NetApp SnapCenter: all versions
- NetApp Solidfire Baseboard Management Controller Firmware: all versions
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Communications Cloud Native Core Binding Support Function: 1.11.0, 22.1.3
- Oracle Communications Cloud Native Core Console: 22.2.0
- Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0
- Oracle Communications Cloud Native Core Network Repository Function: 1.15.0, 1.15.1, 22.1.0, 22.2.0
- Oracle Communications Cloud Native Core Network Slice Selection Function: 1.8.0
- Oracle Communications Cloud Native Core Security Edge Protection Proxy: 22.1.1
- Oracle Communications Cloud Native Core Service Communication Proxy: 1.15.0
- MySQL Server: from 5.7.0 through 5.7.35; from 8.0.0 through 8.0.26
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.57, 8.58, 8.59
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
- Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6
How to fix
Upgrade to a fixed version: Apple macOS 12.3; curl 7.79.0; Siemens Sinec Infrastructure Network Services 1.0.1.1; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.
References
- http://seclists.org/fulldisclosure/2022/Mar/29
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1334111
- https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20211029-0003/
- https://security.netapp.com/advisory/ntap-20220121-0008/
- https://support.apple.com/kb/HT213183
- https://www.debian.org/security/2022/dsa-5197
Get alerted when CVE-2021-22946 or the next vulnerability affects your stack