SNOW-619792: curlcurl-7_68_0: 20 vulnerabilities (highest severity is: 8.1) - autoclosed

Vulnerable Library - curlcurl-7_68_0

A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features

Library home page: https://github.com/bagder/curl.git

Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/connect.c /deps/curl-7.68.0/lib/connect.c /deps/curl-7.68.0/lib/multi.c /deps/curl-7.68.0/lib/easy.c

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2022-22576	High	8.1	curlcurl-7_68_0	Direct	curl-7_83_0	❌
CVE-2020-8231	High	7.5	curlcurl-7_68_0	Direct	curl-7_72_0	❌
CVE-2020-8285	High	7.5	curlcurl-7_68_0	Direct	7.74.0	❌
CVE-2021-22926	High	7.5	curlcurl-7_68_0	Direct	curl-7_78_0	❌
CVE-2022-27782	High	7.5	curlcurl-7_68_0	Direct	curl-7_83_1	❌
CVE-2022-27775	High	7.5	curlcurl-7_68_0	Direct	curl-7_83_0	❌
CVE-2022-27781	High	7.5	curlcurl-7_68_0	Direct	curl-7_83_1	❌
CVE-2022-32208	Medium	6.6	curlcurl-7_68_0	Direct	curl-7_84_0	❌
CVE-2021-22922	Medium	6.5	curlcurl-7_68_0	Direct	curl-7_78_0	❌
CVE-2022-27776	Medium	6.5	curlcurl-7_68_0	Direct	curl-7_83_0	❌
CVE-2022-32207	Medium	6.2	curlcurl-7_68_0	Direct	curl-7_84_0	❌
CVE-2022-27774	Medium	5.7	curlcurl-7_68_0	Direct	curl-7_83_0	❌
CVE-2021-22876	Medium	5.3	curlcurl-7_68_0	Direct	curl-7_76_0	❌
CVE-2021-22923	Medium	5.3	curlcurl-7_68_0	Direct	curl-7_78_0	❌
CVE-2021-22925	Medium	5.3	curlcurl-7_68_0	Direct	curl-7_78_0	❌
CVE-2022-32205	Medium	4.9	curlcurl-7_68_0	Direct	curl-7_71_0	❌
CVE-2022-32206	Medium	4.9	curlcurl-7_68_0	Direct	curl-7_84_0	❌
CVE-2020-8284	Low	3.7	curlcurl-7_68_0	Direct	7.74.0	❌
CVE-2021-22924	Low	3.7	curlcurl-7_68_0	Direct	curl-7_78_0	❌
CVE-2021-22890	Low	3.7	curlcurl-7_68_0	Direct	curl-7_76_0	❌

Details

CVE-2022-22576

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (1)

/deps/curl-7.68.0/lib/strcase.c

### Vulnerability Details

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

Publish Date: 2022-05-26

URL: CVE-2022-22576

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2022-22576.html

Release Date: 2022-01-05

Fix Resolution: curl-7_83_0

CVE-2020-8231

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/connect.c /deps/curl-7.68.0/lib/connect.c /deps/curl-7.68.0/lib/multi.c /deps/curl-7.68.0/lib/easy.c

### Vulnerability Details

Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

Publish Date: 2020-12-14

URL: CVE-2020-8231

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-12-14

Fix Resolution: curl-7_72_0

CVE-2020-8285

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/ftp.c /deps/curl-7.68.0/lib/ftp.c

### Vulnerability Details

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

Publish Date: 2020-12-14

URL: CVE-2020-8285

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2020-8285.html

Release Date: 2020-12-14

Fix Resolution: 7.74.0

CVE-2021-22926

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/vtls/sectransp.c /deps/curl-7.68.0/lib/vtls/sectransp.c

### Vulnerability Details

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

Publish Date: 2021-08-05

URL: CVE-2021-22926

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22926.html

Release Date: 2021-08-05

Fix Resolution: curl-7_78_0

CVE-2022-27782

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/vtls/vtls.c /deps/curl-7.68.0/lib/vtls/mbedtls.c /deps/curl-7.68.0/lib/vtls/gtls.c /deps/curl-7.68.0/lib/vtls/nss.c

### Vulnerability Details

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Publish Date: 2022-06-02

URL: CVE-2022-27782

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2022-27782.html

Release Date: 2022-06-02

Fix Resolution: curl-7_83_1

CVE-2022-27775

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/conncache.c /deps/curl-7.68.0/lib/conncache.c

### Vulnerability Details

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.

Publish Date: 2022-06-02

URL: CVE-2022-27775

### CVSS 3 Score Details (7.5)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/1546268

Release Date: 2022-06-02

Fix Resolution: curl-7_83_0

CVE-2022-27781

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/vtls/nss.c /deps/curl-7.68.0/lib/vtls/nss.c

### Vulnerability Details

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Publish Date: 2022-06-02

URL: CVE-2022-27781

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2022-27781.html

Release Date: 2022-06-02

Fix Resolution: curl-7_83_1

CVE-2022-32208

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/krb5.c /deps/curl-7.68.0/lib/krb5.c

### Vulnerability Details

In curl before 7_84_0, errors are incorrectly handled in gss_unwrap GSS_S_BAD_SIG. An attacker can inject arbitrary FTP server responses to GSSAPI protected FTP control connection and/or make the client consume unrelated heap memory as a FTP command response. This may lead to a potential leak of local heap memory to client.

Publish Date: 2022-06-02

URL: CVE-2022-32208

### CVSS 3 Score Details (6.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2022-32208

Release Date: 2022-06-02

Fix Resolution: curl-7_84_0

CVE-2021-22922

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (4)

/deps/curl-7.68.0/src/tool_operate.c /deps/curl-7.68.0/src/tool_getparam.c /deps/curl-7.68.0/src/tool_cfgable.h /deps/curl-7.68.0/src/tool_sdecls.h

### Vulnerability Details

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

Publish Date: 2021-08-05

URL: CVE-2021-22922

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22922.html

Release Date: 2021-08-05

Fix Resolution: curl-7_78_0

CVE-2022-27776

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/http.c /deps/curl-7.68.0/lib/http.c

### Vulnerability Details

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

Publish Date: 2022-06-02

URL: CVE-2022-27776

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/1547048

Release Date: 2022-06-02

Fix Resolution: curl-7_83_0

CVE-2022-32207

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/cookie.c /deps/curl-7.68.0/lib/cookie.c

### Vulnerability Details

Curl before 7_84_0 fails to preserve file permissions when writing CURLOPT_HSTS, CURLOPT_ALTSVC and CURLOPT_COOKIEJAR databases. Instead, the permissions are always reset to 0666 & ~umask if the file is updated. This may lead to sensitive information exposure.

Publish Date: 2022-06-02

URL: CVE-2022-32207

### CVSS 3 Score Details (6.2)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-06-02

Fix Resolution: curl-7_84_0

CVE-2022-27774

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/vtls/gtls.c /deps/curl-7.68.0/lib/vtls/gtls.c

### Vulnerability Details

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Publish Date: 2022-06-02

URL: CVE-2022-27774

### CVSS 3 Score Details (5.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/1543773

Release Date: 2022-03-24

Fix Resolution: curl-7_83_0

CVE-2021-22876

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/transfer.c /deps/curl-7.68.0/lib/transfer.c

### Vulnerability Details

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Publish Date: 2021-04-01

URL: CVE-2021-22876

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22876.html

Release Date: 2021-04-01

Fix Resolution: curl-7_76_0

CVE-2021-22923

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (4)

/deps/curl-7.68.0/src/tool_operate.c /deps/curl-7.68.0/src/tool_getparam.c /deps/curl-7.68.0/src/tool_cfgable.h /deps/curl-7.68.0/src/tool_sdecls.h

### Vulnerability Details

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

Publish Date: 2021-08-05

URL: CVE-2021-22923

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22923.html

Release Date: 2021-08-05

Fix Resolution: curl-7_78_0

CVE-2021-22925

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/lib/telnet.c /deps/curl-7.68.0/lib/telnet.c

### Vulnerability Details

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

Publish Date: 2021-08-05

URL: CVE-2021-22925

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22925.html

Release Date: 2021-08-05

Fix Resolution: curl-7_78_0

CVE-2022-32205

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/http.c /deps/curl-7.68.0/lib/http_proxy.c /deps/curl-7.68.0/lib/http_proxy.c /deps/curl-7.68.0/lib/http.c

### Vulnerability Details

Curl before 7_71_0 fails to limit the number of cookies that can be set by a single host/domain. A constructed request towards a host can end up consuming more than DYN_HTTP_REQUEST memory, leading to instant CURLE_OUT_OF_MEMORY. Any host in a given domain can target any other hosts in the same domain by using domain cookies. This issue can lead to Denial Of Service from HTTP, HTTPS, and from unprivileged ports.

Publish Date: 2022-06-02

URL: CVE-2022-32205

### CVSS 3 Score Details (4.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-06-02

Fix Resolution: curl-7_71_0

CVE-2022-32206

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (1)

/deps/curl-7.68.0/lib/content_encoding.c

### Vulnerability Details

Curl before 7_84_0 does not prevent resource consumption when processing certain header types and keeps on allocating more and more resources until the application terminates. This uncontrolled resource consumption may lead to a system crash.

Publish Date: 2022-06-02

URL: CVE-2022-32206

### CVSS 3 Score Details (4.9)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-06-02

Fix Resolution: curl-7_84_0

CVE-2020-8284

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (2)

/deps/curl-7.68.0/src/tool_cfgable.c /deps/curl-7.68.0/src/tool_cfgable.c

### Vulnerability Details

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Publish Date: 2020-12-14

URL: CVE-2020-8284

### CVSS 3 Score Details (3.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2020-8284.html

Release Date: 2020-12-14

Fix Resolution: 7.74.0

CVE-2021-22924

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/vtls/vtls.c /deps/curl-7.68.0/lib/vtls/nss.c /deps/curl-7.68.0/lib/vtls/gtls.c /deps/curl-7.68.0/lib/vtls/nss.c

### Vulnerability Details

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Publish Date: 2021-08-05

URL: CVE-2021-22924

### CVSS 3 Score Details (3.7)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22924.html

Release Date: 2021-08-05

Fix Resolution: curl-7_78_0

CVE-2021-22890

### Vulnerable Library - curlcurl-7_68_0

Library home page: https://github.com/bagder/curl.git

Found in base branch: master

### Vulnerable Source Files (4)

/deps/curl-7.68.0/lib/vtls/vtls.c /deps/curl-7.68.0/lib/vtls/bearssl.c /deps/curl-7.68.0/lib/vtls/wolfssl.c /deps/curl-7.68.0/lib/vtls/sectransp.c

### Vulnerability Details

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

Publish Date: 2021-04-01

URL: CVE-2021-22890

### CVSS 3 Score Details (3.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://curl.se/docs/CVE-2021-22890.html

Release Date: 2021-04-01

Fix Resolution: curl-7_76_0

snowflakedb / libsnowflakeclient

SNOW-619792: curlcurl-7_68_0: 20 vulnerabilities (highest severity is: 8.1) - autoclosed #450

Vulnerabilities

Details