CVE-2021-22897: haxx curl +21 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-22897

CVSS 5.3 · Medium EPSS 3,0%

Kerentanan Business Logic Errors pada haxx curl, oracle communications cloud native core binding support function +20 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

Rincian

Terbit di NVD: 11 Juni 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-840: Business Logic Errors
CWE-668: Exposure of Resource to Wrong Sphere
EPSS (30 hari): 3,0% peluang dieksploitasi; lebih tinggi dari 86,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
haxx	curl	Versi 7.61.0 hingga 7.76.1
oracle	communications cloud native core binding support function	Versi 1.11.0
oracle	communications cloud native core network function cloud native environment	Versi 1.10.0
oracle	communications cloud native core network repository function	Versi 1.15.0
oracle	communications cloud native core network repository function	Versi 1.15.1
oracle	communications cloud native core network slice selection function	Versi 1.8.0
oracle	communications cloud native core service communication proxy	Versi 1.15.0
oracle	essbase	Semua versi sebelum 11.1.2.4.047
oracle	essbase	Versi 21.0 hingga sebelum 21.3
oracle	mysql server	Semua versi hingga 5.7.34
oracle	mysql server	Versi 8.0.0 hingga 8.0.25
netapp	cloud backup	Semua versi
netapp	solidfire, enterprise sds & hci storage node	Semua versi
netapp	solidfire & hci management node	Semua versi
netapp	solidfire baseboard management controller firmware	Semua versi
netapp	hci compute node firmware	Semua versi
netapp	h300e firmware	Semua versi
netapp	h300s firmware	Semua versi
netapp	h410s firmware	Semua versi
netapp	h500e firmware	Semua versi
netapp	h500s firmware	Semua versi
netapp	h700e firmware	Semua versi
netapp	h700s firmware	Semua versi
siemens	sinec infrastructure network services	Semua versi sebelum 1.0.1.1
splunk	universal forwarder	Versi 8.2.0 hingga sebelum 8.2.12
splunk	universal forwarder	Versi 9.0.0 hingga sebelum 9.0.6
splunk	universal forwarder	Versi 9.1.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://curl.se/docs/CVE-2021-22897.html patch · advisory vendor
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf patch · advisory pihak ketiga
https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511 patch · advisory pihak ketiga
https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
https://hackerone.com/reports/1172857 exploit · issue tracking · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20210727-0007/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.