{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "state": "PUBLISHED", "cveId": "CVE-2021-22946", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "dateUpdated": "2026-04-16T13:53:47.481Z", "dateReserved": "2021-01-06T00:00:00.000Z", "datePublished": "2021-09-29T00:00:00.000Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2022-12-19T00:00:00.000Z" }, "descriptions": [ { "lang": "en", "value": "A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network." } ], "affected": [ { "vendor": "n/a", "product": "https://github.com/curl/curl", "versions": [ { "version": "curl 7.20.0 to and including 7.78.0", "status": "affected" } ] } ], "references": [ { "url": "https://hackerone.com/reports/1334111" }, { "name": "[debian-lts-announce] 20210930 [SECURITY] [DLA 2773-1] curl security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html" }, { "name": "FEDORA-2021-fc96a3a749", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/" }, { "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "name": "FEDORA-2021-1d24845e93", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/" }, { "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "url": "https://security.netapp.com/advisory/ntap-20211029-0003/" }, { "url": "https://security.netapp.com/advisory/ntap-20220121-0008/" }, { "name": "20220314 APPLE-SA-2022-03-14-4 macOS Monterey 12.3", "tags": [ "mailing-list" ], "url": "http://seclists.org/fulldisclosure/2022/Mar/29" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf" }, { "url": "https://support.apple.com/kb/HT213183" }, { "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "name": "DSA-5197", "tags": [ "vendor-advisory" ], "url": "https://www.debian.org/security/2022/dsa-5197" }, { "name": "[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html" }, { "name": "GLSA-202212-01", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/202212-01" } ], "problemTypes": [ { "descriptions": [ { "type": "CWE", "lang": "en", "description": "Missing Required Cryptographic Step (CWE-325)", "cweId": "CWE-325" } ] } ] }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:58:26.135Z" }, "title": "CVE Program Container", "references": [ { "url": "https://hackerone.com/reports/1334111", "tags": [ "x_transferred" ] }, { "name": "[debian-lts-announce] 20210930 [SECURITY] [DLA 2773-1] curl security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html" }, { "name": "FEDORA-2021-fc96a3a749", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/" }, { "url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "tags": [ "x_transferred" ] }, { "name": "FEDORA-2021-1d24845e93", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/" }, { "url": "https://www.oracle.com/security-alerts/cpujan2022.html", "tags": [ "x_transferred" ] }, { "url": "https://security.netapp.com/advisory/ntap-20211029-0003/", "tags": [ "x_transferred" ] }, { "url": "https://security.netapp.com/advisory/ntap-20220121-0008/", "tags": [ "x_transferred" ] }, { "name": "20220314 APPLE-SA-2022-03-14-4 macOS Monterey 12.3", "tags": [ "mailing-list", "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2022/Mar/29" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "tags": [ "x_transferred" ] }, { "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf", "tags": [ "x_transferred" ] }, { "url": "https://support.apple.com/kb/HT213183", "tags": [ "x_transferred" ] }, { "url": "https://www.oracle.com/security-alerts/cpujul2022.html", "tags": [ "x_transferred" ] }, { "name": "DSA-5197", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.debian.org/security/2022/dsa-5197" }, { "name": "[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html" }, { "name": "GLSA-202212-01", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202212-01" } ] }, { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-319", "lang": "en", "description": "CWE-319 Cleartext Transmission of Sensitive Information" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2026-04-16T13:53:35.942299Z", "id": "CVE-2021-22946", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:53:47.481Z" } } ] } }