Ubuntu.comUB:CVE-2021-22897CVE-2021-22897
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.003 Low
EPSS
Percentile
68.7%
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong
session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when
libcurl is built to use the Schannel TLS library. The selected cipher set
was stored in a single “static” variable in the library, which has the
surprising side-effect that if an application sets up multiple concurrent
transfers, the last one that sets the ciphers will accidentally control the
set used by all transfers. In a worst-case scenario, this weakens transport
security significantly.
Notes
| Author | Note |
|---|---|
| seth-arnold | only affects builds with SCHANNEL – I believe that requires windows. |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.003 Low
EPSS
Percentile
68.7%