curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library which has the surprising side-effect that if an application sets up multiple concurrent transfers the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario this weakens transport security significantly.

🗓️ 23 Jun 2021 07:00:00Reported by MicrosoftType

Curl 7.61.0–7.76.1 exposes cipher data to wrong session via a static cipher list with Schannel.

Reporter	Title	Published	Views	Family All 129
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	7 May 202417:05	–	ibm
IBM Security Bulletins	Security Bulletin: curl vulnerability impacting Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, Aspera Desktop Client 4.1.1 and earlier (CVE-2021-22897)	3 Aug 202119:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	1 Nov 202120:13	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability was identified and remediated in the IBM MaaS360 Cloud Extender (V2.103.000.051) and Modules	10 Aug 202120:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues	17 Oct 202400:12	–	ibm
AlpineLinux	CVE-2021-22897	11 Jun 202115:49	–	alpinelinux
CBLMariner	CVE-2021-22897 affecting package curl 7.76.0-9	8 Jul 202121:56	–	cbl_mariner
CBLMariner	CVE-2021-22897 affecting package curl for versions less than 7.76.0-5	9 Apr 202206:51	–	cbl_mariner
CNNVD	Haxx libcurl 加密问题漏洞	26 May 202100:00	–	cnnvd
CVE	CVE-2021-22897	11 Jun 202115:49	–	cve