High severity7.5NVD Advisory· Published Sep 29, 2021· Updated Apr 16, 2026

CVE-2021-22946

Description

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (--ssl-reqd on the command line orCURLOPT_USE_SSL set to CURLUSESSL_CONTROL or CURLUSESSL_ALL withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations withoutTLS contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Curl/Curl2 versions
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*range: >=7.20.0,<7.79.0
- (no CPE)range: >=7.20.0, <=7.78.0
NetApp/Cloud Backup
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
NetApp/Clustered Data Ontap
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
NetApp/Oncommand Insight
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
NetApp/Oncommand Workflow Automation
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
NetApp/Snapcenter
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
Oracle Corporation/Commerce Guided Search
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Binding Support Function2 versions
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Console
cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Network Function Cloud Native Environment
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Network Repository Function4 versions
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Network Slice Selection Function
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Security Edge Protection Proxy
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Service Communication Proxy
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*
Oracle Corporation/Mysql Server
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Range: >=5.7.0,<=5.7.35
Oracle Corporation/Peoplesoft Enterprise Peopletools3 versions
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
Siemens Foundation/Sinec Infrastructure Network Services
cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*
Range: <1.0.1.1
Splunk/Universal Forwarder2 versions
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*range: >=8.2.0,<8.2.12
- cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
Apple Inc./macOS
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Range: <12.3
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
NetApp/H300e Firmware
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
NetApp/H300s Firmware
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
NetApp/H410s Firmware
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
NetApp/H500e Firmware
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
NetApp/H500s Firmware
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
NetApp/H700e Firmware
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
NetApp/H700s Firmware
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
NetApp/Solidfire Baseboard Management Controller Firmware
cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*
Curl/Libcurlllm-fuzzy
Range: >=7.20.0, <=7.78.0
osv-coords26 versions
pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/curl-mini&distro=openSUSE%20Leap%2015.2 pkg:rpm/suse/curl&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.0 pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.1 pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2 pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3 pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/curl&distro=SUSE%20OpenStack%20Cloud%209 pkg:rpm/suse/curl&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209 pkg:rpm/suse/curl-openssl1&distro=SUSE%20Linux%20Enterprise%20Server%2011-SECURITY
< 7.66.0-lp152.3.24.1+ 25 more
- (no CPE)range: < 7.66.0-lp152.3.24.1
- (no CPE)range: < 7.66.0-4.27.1
- (no CPE)range: < 7.79.1-1.1
- (no CPE)range: < 7.66.0-lp152.3.24.1
- (no CPE)range: < 7.60.0-25.1
- (no CPE)range: < 7.60.0-25.1
- (no CPE)range: < 7.60.0-25.1
- (no CPE)range: < 7.60.0-25.1
- (no CPE)range: < 7.60.0-25.1
- (no CPE)range: < 7.66.0-4.27.1
- (no CPE)range: < 7.66.0-4.27.1
- (no CPE)range: < 7.66.0-4.27.1
- (no CPE)range: < 7.66.0-4.27.1
- (no CPE)range: < 7.60.0-4.30.1
- (no CPE)range: < 7.60.0-11.28.1
- (no CPE)range: < 7.60.0-25.1
- (no CPE)range: < 7.60.0-25.1
- (no CPE)range: < 7.60.0-25.1
- (no CPE)range: < 7.60.0-4.30.1
- (no CPE)range: < 7.60.0-11.28.1
- (no CPE)range: < 7.60.0-25.1
- (no CPE)range: < 7.60.0-25.1
- (no CPE)range: < 7.60.0-11.28.1
- (no CPE)range: < 7.60.0-4.30.1
- (no CPE)range: < 7.60.0-4.30.1
- (no CPE)range: < 7.37.0-70.74.1

Patches

Vulnerability mechanics

References

cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfnvdPatchThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party Advisory
www.oracle.com/security-alerts/cpujul2022.htmlnvdPatchThird Party Advisory
www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party Advisory
hackerone.com/reports/1334111nvdExploitIssue TrackingPatchThird Party Advisory
seclists.org/fulldisclosure/2022/Mar/29nvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2021/09/msg00022.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2022/08/msg00017.htmlnvdMailing ListThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/nvdMailing ListThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/nvdMailing ListThird Party Advisory
security.gentoo.org/glsa/202212-01nvdThird Party Advisory
security.netapp.com/advisory/ntap-20211029-0003/nvdThird Party Advisory
security.netapp.com/advisory/ntap-20220121-0008/nvdThird Party Advisory
support.apple.com/kb/HT213183nvdRelease NotesThird Party Advisory
www.debian.org/security/2022/dsa-5197nvdThird Party Advisory
www.oracle.com/security-alerts/cpujan2022.htmlnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.003
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000