PT-2021-5797 · Lynx+8 · Lynx+8

Ariadne Conill + 2 · Published 2021-03-15 · Updated 2026-02-09 · CVE-2021-38165

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lynx versions 2.8.9 and earlier

Description The issue is related to the mishandling of the userinfo subcomponent of a URI, allowing remote attackers to discover cleartext credentials because they may appear in SNI data or HTTP headers. This can enable a remote attacker to access confidential data.

Recommendations For versions 2.8.9 and earlier, update to a version that fixes the userinfo subcomponent handling issue to prevent cleartext credentials from being exposed in SNI data or HTTP headers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

ALSA-2022:2129

ALT-PU-2025-4725

BDU:2022-00255

CESA-2022_2129

CVE-2021-38165

DLA-2736-1

DSA-4953-1

MGASA-2021-0422

OESA-2021-1326

RHSA-2022:2129

RHSA-2022_2129

USN-4800-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Lynx

Red Hat

Red Os

Ubuntu

References · 51

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKNK7GQBJBUBMJVNKVC7RTCYWUYMFJQW · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1326 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38165 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:2129 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0422 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-38165 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7YMUHFJJWTZ6HBHTYXVDPNZINGGURHDW · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9179 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4953-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4800-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38165 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-1000211 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K6PZF7JNTFCOJ62HXZG4Q2NEHSZ6IO2V · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38165 · Vendor Advisory