Summary
Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled
TELNET connections when the -t option was used on the command line.
Uninitialized data possibly containing sensitive information could be sent
to the remote server, contrary to expectations. (CVE-2021-22898,
CVE-2021-22925)
Harry Sintonen discovered that curl incorrectly reused connections in the
connection pool. This could result in curl reusing the wrong connections.
(CVE-2021-22924)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | curl | 7.58.0-2ubuntu3.14 |
| Ubuntu · 20.04 LTS 20.04:LTS | curl | 7.68.0-1ubuntu2.6 |
Vulnerabilities 3
-
Medium 5.3
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used…
-
Low 3.7CVE-2021-22924 Public exploit
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches…
-
Low 3.1
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TEL…