CVE-2021-22898: haxx curl +11 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-22898

CVSS 3.1 · Low EPSS 4,5%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada haxx curl, debian linux +10 lainnya. Skor CVSS 3.1 3.1 (Low) menurut NVD.

Deskripsi (NVD)

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

Rincian

Terbit di NVD: 11 Juni 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 3.1 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-909: Missing Initialization of Resource
EPSS (30 hari): 4,5% peluang dieksploitasi; lebih tinggi dari 91,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
haxx	curl	Versi 7.7 hingga 7.76.1
debian	debian linux	Versi 9.0
fedoraproject	fedora	Versi 33
fedoraproject	fedora	Versi 34
oracle	communications cloud native core binding support function	Versi 1.11.0
oracle	communications cloud native core network function cloud native environment	Versi 1.10.0
oracle	communications cloud native core network repository function	Versi 1.15.0
oracle	communications cloud native core network repository function	Versi 1.15.1
oracle	communications cloud native core network slice selection function	Versi 1.8.0
oracle	communications cloud native core service communication proxy	Versi 1.15.0
oracle	essbase	Semua versi sebelum 11.1.2.4.047
oracle	essbase	Versi 21.0 hingga sebelum 21.3
oracle	mysql server	Semua versi sebelum 5.7.34
oracle	mysql server	Versi 8.0.15 hingga sebelum 8.0.25
siemens	sinec infrastructure network services	Semua versi sebelum 1.0.1.1
splunk	universal forwarder	Versi 8.2.0 hingga sebelum 8.2.12
splunk	universal forwarder	Versi 9.0.0 hingga sebelum 9.0.6
splunk	universal forwarder	Versi 9.1.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://curl.se/docs/CVE-2021-22898.html exploit · patch · advisory vendor
http://www.openwall.com/lists/oss-security/2021/07/21/4 mailing list · patch · advisory pihak ketiga
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf patch · advisory pihak ketiga
https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde patch · advisory pihak ketiga
https://hackerone.com/reports/1176461 exploit · issue tracking · patch · advisory pihak ketiga
https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.gua... mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZ... mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POOC3UV7V6L4C... mailing list · advisory pihak ketiga
https://www.debian.org/security/2022/dsa-5197 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.