CVE-2021-22925

2021-08-0521:15:11

Google

osv.dev

0.003 Low

EPSS

Percentile

69.5%

JSON

curl supports the -t command line option, known as CURLOPT_TELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending NEW_ENV variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

CPENameOperatorVersion
curleqcurl-7_65_1
curleq7.64.1-r3
curleqcurl-7_45_0
curleqcurl-7_72_0
curleqcurl-7_71_0
curleqcurl-7_9_4
curleqCurl_easy_1-1-7
curleqcurl-7_10_5
curleqcurl-7_21_1
curleqcurl-7_64_0

Name	Operator	Version
curl	eq	curl-7_65_1
curl	eq	7.64.1-r3
curl	eq	curl-7_45_0
curl	eq	curl-7_72_0
curl	eq	curl-7_71_0
curl	eq	curl-7_9_4
curl	eq	Curl_easy_1-1-7
curl	eq	curl-7_10_5
curl	eq	curl-7_21_1
curl	eq	curl-7_64_0