PT-2021-4653 · Curl+10 · Curl+10
Published
2021-09-15
·
Updated
2026-05-18
·
CVE-2021-22947
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
curl versions 7.20.0 through 7.78.0
Description
The issue concerns the implementation of the STARTTLS protocol in curl, which can lead to insufficient authentication of data. This allows a Man-In-The-Middle attacker to inject fake responses before the TLS handshake, and then pass through the legitimate server's TLS traffic, tricking curl into trusting the attacker's injected data as if it came from the TLS-protected server. Over POP3 and IMAP, an attacker can inject fake response data.
Recommendations
For curl versions 7.20.0 through 7.78.0, update to version 7.79.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the STARTTLS protocol until a patch is available. Avoid using the vulnerable protocol to minimize the risk of exploitation.
Exploit
Fix
RCE
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Linuxmint
Apple Macos
Red Hat
Rocky Linux
Suse
Ubuntu
Windows
Curl