PT-2021-6777 · Curl+6 · Curl+6
Published
2021-07-21
·
Updated
2026-05-18
·
CVE-2021-22922
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
curl (affected versions not specified)
Description
The issue is related to the metalink feature in curl, which allows downloading content from multiple URLs. When a server hosting the content is breached and the file is replaced with a modified payload, curl should detect the hash mismatch after a completed download and remove the contents. However, this does not happen, and the potentially malicious content is kept on disk. The metalink XML file provides a hash to verify the contents, but a hash mismatch is only mentioned in text, and the user may not notice the message.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Debian
Red Hat
Rocky Linux
Suse
Curl