CVE-2021-22945

2021-09-1500:00:00

ubuntu.com

cve-2021-22945

libcurl

mqtt

memory area

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

0.007

Percentile

80.2%

JSON

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in
some circumstances erroneously keep a pointer to an already freed memory
area and both use that again in a subsequent call to send data and also
free it again.

Notes

Author	Note
alexmurray	MQTT sending support is only present in curl >= 7.70 - see Message-ID: <nycvar.QRO.7.76.2109061032590.1742@fvyyl>

OSVersionArchitecturePackageVersionFilename
ubuntu21.04noarchcurl< 7.74.0-1ubuntu2.3UNKNOWN
ubuntu21.10noarchcurl< 7.74.0-1.3ubuntu2UNKNOWN
ubuntu22.04noarchcurl< 7.74.0-1.3ubuntu2UNKNOWN