CVE-2021-22897

medium Splunk
CVSS v3 Base Score
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.8%
Exploitation probability in 30 days
Top 26% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Published: June 11, 2021 (1855 days ago)
Last Modified: May 28, 2026
Vendor: Splunk
Source: NVD

Description

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

CWE

CWE-840

Affected Products

haxx curloracle communications cloud native core binding support functionoracle communications cloud native core network function cloud native environmentoracle communications cloud native core network repository functionoracle communications cloud native core network slice selection functionoracle communications cloud native core service communication proxyoracle essbaseoracle mysql servernetapp cloud backupnetapp solidfire\, enterprise sds \& hci storage node

References

🔗 cert-portal.siemens.com 🔗 curl.se 🔗 github.com 🔗 hackerone.com 🔗 security.netapp.com