CVE-2021-22897

A flaw was found in curl where libcurl lets applications specify which specific TLS ciphers to use in transfers, using the option called CURLOPT_SSL_CIPHER_LIST. The cipher selection is used for the TLS negotiation when a transfer is done involving any of the TLS based transfer protocols libcurl supports, such as HTTPS, FTPS, IMAPS, POP3S, SMTPS, etc. Due to a mistake in the code, the selected cipher set was stored in a single “static” variable in the library, which contains a side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly. The highest threat from this vulnerability is to confidentiality.