CVE-2021-22923

Name	CVE-2021-22923
Description	When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	low

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	stretch	7.52.1-5+deb9u10	vulnerable
	stretch (security)	7.52.1-5+deb9u16	vulnerable
	buster, buster (security)	7.64.0-4+deb10u2	vulnerable
	bookworm, bullseye, sid	7.74.0-1.3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
curl	source	(unstable)	(unfixed)	unimportant

Notes

https://curl.se/docs/CVE-2021-22923.html
https://www.openwall.com/lists/oss-security/2021/07/21/2
The fix for earlier versions is to rebuild curl with the metalink support
switched off.
Metalink support not enabled in Debian builds.