Low severity3.7NVD Advisory· Published Aug 5, 2021· Updated Jun 17, 2026
CVE-2021-22924
CVE-2021-22924
Description
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
30- libcurl/libcurldescription
- osv-coords28 versionspkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/curl-mini&distro=openSUSE%20Leap%2015.2pkg:rpm/suse/curl&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.0pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/curl&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/curl&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/curl&distro=SUSE%20Manager%20Server%204.0pkg:rpm/suse/curl&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/curl&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/curl-openssl1&distro=SUSE%20Linux%20Enterprise%20Server%2011-SECURITY
< 7.66.0-lp152.3.21.1+ 27 more
- (no CPE)range: < 7.66.0-lp152.3.21.1
- (no CPE)range: < 7.66.0-4.22.1
- (no CPE)range: < 7.79.1-1.1
- (no CPE)range: < 7.66.0-lp152.3.21.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.66.0-4.22.1
- (no CPE)range: < 7.66.0-4.22.1
- (no CPE)range: < 7.66.0-4.22.1
- (no CPE)range: < 7.60.0-4.25.1
- (no CPE)range: < 7.60.0-11.23.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-4.25.1
- (no CPE)range: < 7.60.0-11.23.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-11.23.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-3.47.1
- (no CPE)range: < 7.60.0-4.25.1
- (no CPE)range: < 7.60.0-4.25.1
- (no CPE)range: < 7.37.0-70.71.1
Patches
Vulnerability mechanics
References
15- cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfnvdPatchThird Party Advisory
- www.oracle.com/security-alerts/cpujan2022.htmlnvdPatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party Advisory
- hackerone.com/reports/1223565nvdExploitIssue TrackingPatchThird Party Advisory
- cert-portal.siemens.com/productcert/pdf/ssa-484086.pdfnvdThird Party Advisory
- cert-portal.siemens.com/productcert/pdf/ssa-732250.pdfnvdThird Party Advisory
- lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3EnvdMailing ListThird Party Advisory
- lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3EnvdMailing ListThird Party Advisory
- lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3EnvdMailing ListThird Party Advisory
- lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3EnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/08/msg00017.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2022/08/msg00017.htmlnvdMailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/nvdMailing ListThird Party Advisory
- security.netapp.com/advisory/ntap-20210902-0003/nvdThird Party Advisory
- www.debian.org/security/2022/dsa-5197nvdThird Party Advisory
News mentions
0No linked articles in our index yet.