CVE-2021-22946

Protocol downgraderequired TLS bypassed

Project curl Security Advisory, September 15th 2021 -Permalink

VULNERABILITY

A user can tell curl torequire a successful upgradeto TLS when speaking to an IMAP, POP3 or FTP server(--ssl-reqd on the command line orCURLOPT_USE_SSL set toCURLUSESSL_CONTROL orCURLUSESSL_ALL with libcurl). This requirement could bebypassed if the server would return a properly crafted but perfectlylegitimate response.

This flaw would then make curl silently continue its operationswithout TLS contrary to the instructions andexpectations, exposing possibly sensitive data in clear text over thenetwork.

INFO

SMTP also features a similar TLS upgrade method, but that code incurl does not suffer from this bug.

The Common Vulnerabilities and Exposures (CVE) project has assignedthe name CVE-2021-22946 to this issue.

CWE-325: Missing Cryptographic Step

Severity: Medium

AFFECTED VERSIONS

• Affected versions: curl7.20.0 to and including7.78.0
• Not affected versions: curl <7.20.0 and curl >=7.79.0
• Introduced-in:https://github.com/curl/curl/commit/ec3bb8f727405

Also note that libcurl is used by many applications, and not alwaysadvertised as such.

SOLUTION

• Fixed-in:https://github.com/curl/curl/commit/364f174724ef11

RECOMMENDATIONS

A - Upgrade curl to version7.79.0

B - Apply the patch to your local version

C - Do not use IMAP, POP3 or FTP

TIMELINE

This issue was reported to the curl project on September 8, 2021.

This advisory was posted on September 15, 2021.

CREDITS

• Reported-by: Patrick Monnerat
• Patched-by: Patrick Monnerat

Thanks a lot!