CVE-2021-22946

NameCVE-2021-22946
DescriptionA user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2773-1, DLA-3085-1, DSA-5197-1
Debian Bugs1017589

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
curl (PTS)buster7.64.0-4+deb10u2vulnerable
buster (security)7.64.0-4+deb10u9fixed
bullseye (security), bullseye7.74.0-1.3+deb11u11fixed
bookworm, bookworm (security)7.88.1-10+deb12u5fixed
trixie8.7.1-5fixed
sid8.8.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
curlsourcestretch7.52.1-5+deb9u16DLA-2773-1
curlsourcebuster7.64.0-4+deb10u3DLA-3085-1
curlsourcebullseye7.74.0-1.3+deb11u2DSA-5197-1
curlsource(unstable)7.79.1-11017589

Notes

https://curl.se/docs/CVE-2021-22946.html
Fixed by: https://github.com/curl/curl/commit/364f174724ef115c63d5e5dc1d3342c8a43b1cca (curl-7_79_0)

Search for package or bug name: Reporting problems