ID

VAR-202108-2221

CVE

CVE-2021-22925

TITLE

Arch Linux Security hole

DESCRIPTION

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application. A has been found in curl. The fix for CVE-2021-22898 doesn't remedy the vulnerability. The highest threat from this vulnerability is to confidentiality. Bugs fixed (https://bugzilla.redhat.com/): 1944888 - CVE-2021-21409 netty: Request smuggling via content-length header 2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data 2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way 2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value 5. JIRA issues fixed (https://issues.jboss.org/): LOG-1897 - Applying cluster state is causing elasticsearch to hit an issue and become unusable LOG-1925 - [release-5.3] No datapoint for CPU on openshift-logging dashboard LOG-1962 - [release-5.3] CLO panic: runtime error: slice bounds out of range [:-1] 6. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: curl security and bug fix update Advisory ID: RHSA-2021:4511-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4511 Issue date: 2021-11-09 CVE Names: CVE-2021-22876 CVE-2021-22898 CVE-2021-22925 ==================================================================== 1. Summary: An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876) * curl: TELNET stack contents disclosure (CVE-2021-22898) * curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1941964 - CVE-2021-22876 curl: Leak of authentication credentials in URL via automatic Referer 1947493 - Why there is a difference between curl --head output on the RHEL7 and RHEL8. 1964887 - CVE-2021-22898 curl: TELNET stack contents disclosure 1970902 - CVE-2021-22925 curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure 6. Package List: Red Hat Enterprise Linux BaseOS (v. 8): Source: curl-7.61.1-22.el8.src.rpm aarch64: curl-7.61.1-22.el8.aarch64.rpm curl-debuginfo-7.61.1-22.el8.aarch64.rpm curl-debugsource-7.61.1-22.el8.aarch64.rpm curl-minimal-debuginfo-7.61.1-22.el8.aarch64.rpm libcurl-7.61.1-22.el8.aarch64.rpm libcurl-debuginfo-7.61.1-22.el8.aarch64.rpm libcurl-devel-7.61.1-22.el8.aarch64.rpm libcurl-minimal-7.61.1-22.el8.aarch64.rpm libcurl-minimal-debuginfo-7.61.1-22.el8.aarch64.rpm ppc64le: curl-7.61.1-22.el8.ppc64le.rpm curl-debuginfo-7.61.1-22.el8.ppc64le.rpm curl-debugsource-7.61.1-22.el8.ppc64le.rpm curl-minimal-debuginfo-7.61.1-22.el8.ppc64le.rpm libcurl-7.61.1-22.el8.ppc64le.rpm libcurl-debuginfo-7.61.1-22.el8.ppc64le.rpm libcurl-devel-7.61.1-22.el8.ppc64le.rpm libcurl-minimal-7.61.1-22.el8.ppc64le.rpm libcurl-minimal-debuginfo-7.61.1-22.el8.ppc64le.rpm s390x: curl-7.61.1-22.el8.s390x.rpm curl-debuginfo-7.61.1-22.el8.s390x.rpm curl-debugsource-7.61.1-22.el8.s390x.rpm curl-minimal-debuginfo-7.61.1-22.el8.s390x.rpm libcurl-7.61.1-22.el8.s390x.rpm libcurl-debuginfo-7.61.1-22.el8.s390x.rpm libcurl-devel-7.61.1-22.el8.s390x.rpm libcurl-minimal-7.61.1-22.el8.s390x.rpm libcurl-minimal-debuginfo-7.61.1-22.el8.s390x.rpm x86_64: curl-7.61.1-22.el8.x86_64.rpm curl-debuginfo-7.61.1-22.el8.i686.rpm curl-debuginfo-7.61.1-22.el8.x86_64.rpm curl-debugsource-7.61.1-22.el8.i686.rpm curl-debugsource-7.61.1-22.el8.x86_64.rpm curl-minimal-debuginfo-7.61.1-22.el8.i686.rpm curl-minimal-debuginfo-7.61.1-22.el8.x86_64.rpm libcurl-7.61.1-22.el8.i686.rpm libcurl-7.61.1-22.el8.x86_64.rpm libcurl-debuginfo-7.61.1-22.el8.i686.rpm libcurl-debuginfo-7.61.1-22.el8.x86_64.rpm libcurl-devel-7.61.1-22.el8.i686.rpm libcurl-devel-7.61.1-22.el8.x86_64.rpm libcurl-minimal-7.61.1-22.el8.i686.rpm libcurl-minimal-7.61.1-22.el8.x86_64.rpm libcurl-minimal-debuginfo-7.61.1-22.el8.i686.rpm libcurl-minimal-debuginfo-7.61.1-22.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-22876 https://access.redhat.com/security/cve/CVE-2021-22898 https://access.redhat.com/security/cve/CVE-2021-22925 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYrePtzjgjWX9erEAQi1vg/+NwMM5Xa95S/32eA64QYnxTQcWSn6wyzC wHAIvXVu4L9kZrLqCm2zeO6US0KFZ6tCEgjamDjgO+9b1mYso3b3R2DDTbWtq4i+ gsbCths+Bqhn45Qsk9kQdhznS/MF+tWeNK06KnkJ02NmgxcuISWLQirx32Xc230e Hs0P9TarBo04m+6HDC7CeloD8rkqpQJ4nJhX8hujaEUbukSPlkizyT/IlWTAFR9l GLZfIkFpifNqtQzn9j6dxcefXq0BcMfAMsSbRsh7E0oJGi9x79ySEO+r5b4dlsqK 30PfEJxjrFZN3TuqzbG7pfdpKRRmUzdXCHpxb5MxXrkeD7xuzPomrorKayUIQi6g YhESs4khV+i+6zqCNHpYdBcDbxuiYJ1w80kg/31YC7u7YEI4IlMISzw7CctzQEhk +SqVOVKxI8Rn7OZSzb3cR6LubmR1UihMblYHHgaJ9mA7r9zAC7evddzhkxMtQ42P 81V3u0YaZKxWAy8d/brDz2YS/1Y7nnGsjNUaRZxTlWxbcjSz2cf/DPu8A5IiHS6T M/OA8MBC4mFkQkBf4v5PKWBZe6K+gEfmJzfjlQ8nTFhYhHwNtC1z8tMP42ugNGYY ejAfwtZ5Tw3AnuOBeb+bm148KSd/W1UPSUyJh6IrgwzMbkfDNKmKy+7gaIXZ3otd clmEcx7lYW4=7Kqb -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . This update provides the corresponding updates for Ubuntu 16.04 ESM. Solution: OSP 16.2.z Release - OSP Director Operator Containers 4. Bugs fixed (https://bugzilla.redhat.com/): 2025995 - Rebase tech preview on latest upstream v1.2.x branch 2030801 - CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache 2036784 - osp controller (fencing enabled) in downed state after system manual crash test 5. Summary: The Migration Toolkit for Containers (MTC) 1.5.4 is now available. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Bugs fixed (https://bugzilla.redhat.com/): 1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic 5. Summary: Red Hat Advanced Cluster Management for Kubernetes 2.2.11 General Availability release images, which provide one or more container updates and bug fixes. Description: Red Hat Advanced Cluster Management for Kubernetes 2.2.11 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console — with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide security fixes, bug fixes and container upgrades. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.2/html/release_notes/ Security updates: * object-path: Type confusion vulnerability can lead to a bypass of CVE-2020-15256 (CVE-2021-23434) * follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155) Related bugs: * RHACM 2.2.11 images (Bugzilla #2029508) * ClusterImageSet has 4.5 which is not supported in ACM 2.2.10 (Bugzilla #2030859) 3. Bugs fixed (https://bugzilla.redhat.com/): 1999810 - CVE-2021-23434 object-path: Type confusion vulnerability can lead to a bypass of CVE-2020-15256 2029508 - RHACM 2.2.11 images 2030859 - ClusterImageSet has 4.5 which is not supported in ACM 2.2.10 2044556 - CVE-2022-0155 follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor 5. ========================================================================== Ubuntu Security Notice USN-5021-1 July 22, 2021 curl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.04 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in curl. Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries Details: Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t option was used on the command line. Uninitialized data possibly containing sensitive information could be sent to the remote server, contrary to expectations. (CVE-2021-22898, CVE-2021-22925) Harry Sintonen discovered that curl incorrectly reused connections in the connection pool. This could result in curl reusing the wrong connections. (CVE-2021-22924) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 21.04: curl 7.74.0-1ubuntu2.1 libcurl3-gnutls 7.74.0-1ubuntu2.1 libcurl3-nss 7.74.0-1ubuntu2.1 libcurl4 7.74.0-1ubuntu2.1 Ubuntu 20.04 LTS: curl 7.68.0-1ubuntu2.6 libcurl3-gnutls 7.68.0-1ubuntu2.6 libcurl3-nss 7.68.0-1ubuntu2.6 libcurl4 7.68.0-1ubuntu2.6 Ubuntu 18.04 LTS: curl 7.58.0-2ubuntu3.14 libcurl3-gnutls 7.58.0-2ubuntu3.14 libcurl3-nss 7.58.0-2ubuntu3.14 libcurl4 7.58.0-2ubuntu3.14 In general, a standard system update will make all the necessary changes

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Siemens notified CISA of these vulnerabilities.

SOURCES

LAST UPDATE DATE

2025-04-23T22:22:13.951000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE