SUSE update for curl
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2021-22946 CVE-2021-22947 |
| CWE-ID | CWE-319 CWE-345 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
SUSE Linux Enterprise Server Operating systems & Components / Operating system libcurl4-openssl1-x86 Operating systems & Components / Operating system package or component libcurl4-openssl1-32bit Operating systems & Components / Operating system package or component libcurl4-openssl1 Operating systems & Components / Operating system package or component curl-openssl1 Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Cleartext transmission of sensitive information
EUVDB-ID: #VU56613
Risk: Medium
CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-22946
CWE-ID:
CWE-319 - Cleartext Transmission of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an error, related to incorrect enforcement of the --ssl-reqd option on the command line or CURLOPT_USE_SSL setting set to CURLUSESSL_CONTROL or CURLUSESSL_ALL with libcurl. A remote attacker with control over the IMAP, POP3 or FTP server can send a specially crafted but perfectly legitimate response to the libcurl client and force it silently to continue its operations without TLS encryption and transmit data in clear text over the network.
Update the affected package curl to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 11-SECURITY
libcurl4-openssl1-x86: before 7.37.0-70.74.1
libcurl4-openssl1-32bit: before 7.37.0-70.74.1
libcurl4-openssl1: before 7.37.0-70.74.1
curl-openssl1: before 7.37.0-70.74.1
CPE2.3 External linkshttp://www.suse.com/support/update/announcement/2021/suse-su-202114807-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Insufficient verification of data authenticity
EUVDB-ID: #VU56615
Risk: Medium
CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-22947
CWE-ID:
CWE-345 - Insufficient Verification of Data Authenticity
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists in the way libcurl handles the STARTTLS negotiation process. When curl connects to an IMAP, POP3, SMTP or FTP server to exchange data securely using STARTTLS to upgrade the connection to TLS level, the server can still respond and send back multiple responses before the TLS upgrade. Such multiple "pipelined" responses are cached by curl. curl would then upgrade to TLS but not flush the in-queue of cached responses and instead use and trust the responses it got before the TLS handshake as if they were authenticated.
Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
Over POP3 and IMAP an attacker can inject fake response data.
Mitigation
Update the affected package curl to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 11-SECURITY
libcurl4-openssl1-x86: before 7.37.0-70.74.1
libcurl4-openssl1-32bit: before 7.37.0-70.74.1
libcurl4-openssl1: before 7.37.0-70.74.1
curl-openssl1: before 7.37.0-70.74.1
CPE2.3 External linkshttp://www.suse.com/support/update/announcement/2021/suse-su-202114807-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
