Man-in-the-Middle (MITM) Attack

🗓️ 01 Apr 2021 00:29:32Reported by Veracode Vulnerability DatabaseType

curl:buster vulnerability to man-in-the-middle attack due to bad TLS handling by libcurl when using HTTPS proxy and TLS 1.3

Reporter	Title	Published	Views	Family All 114
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2021-22876 and CVE-2021-22890)	14 Jun 202211:49	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability was identified and remediated in the IBM MaaS360 Cloud Extender (V2.103.000.051) and Modules	10 Aug 202120:52	–	ibm
AlpineLinux	CVE-2021-22890	1 Apr 202117:46	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в curl	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the software for interacting with servers via CURL allows for bypassing authentication procedures, enabling attackers to compromise data integrity.	20 Jan 202200:00	–	bdu_fstec
Broadcom	curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection	12 Jun 202300:00	–	broadcom
CBLMariner	CVE-2021-22890 affecting package curl 7.74.0-1	11 Aug 202106:39	–	cbl_mariner
Cloud Foundry	USN-4898-1: curl vulnerabilities \| Cloud Foundry	29 Apr 202100:00	–	cloudfoundry
CNNVD	Haxx libcurl 安全漏洞	31 Mar 202100:00	–	cnnvd
CNVD	HAXX libcurl man-in-the-middle attack vulnerability (CNVD-2021-31934)	2 Apr 202100:00	–	cnvd

Vulners

Node

curl curlMatch7.64.0-4+deb10u1debian

AND

focal focalMatch7.68.0-1ubuntu2.2debian

AND

focal focalMatch7.68.0-1ubuntu2debian

AND

apache groovyMatch7.68.0-1ubuntu4debian

AND

curl curlMatch7.72.0-1debian

AND

curl curlMatch7.72.0-1debian

AND

curl curlMatch7.69.1-r3os

AND

curl curlMatch7.69.1-r0os

AND

curl curlMatch7.74.0-r1os

AND

curl curlMatch7.69.0-r0os

AND

curl curlMatch7.69.0-r1os

AND

curl curlMatch7.75.0-r0os

AND

curl curlMatch7.68.0-r0os

AND

curl curlMatch7.69.1-r0os

AND

Source	Link
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-22890
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC/
security	www.security.gentoo.org/glsa/202105-36
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
curl	www.curl.se/docs/CVE-2021-22890.html

27 Mar 2024 17:14Current

CVSS 24.3

CVSS 3.13.7

EPSS0.00069