Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
CURL-CVE-2021-22897
No affected components available
libcurl lets applications specify which specific TLS ciphers to use in
transfers, using the option called CURLOPT_SSL_CIPHER_LIST. The cipher
selection is used for the TLS negotiation when a transfer is done involving
any of the TLS based transfer protocols libcurl supports, such as HTTPS, FTPS,
IMAPS, POP3S, SMTPS etc.
Due to a mistake in the code, the selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers accidentally controls the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
Measures severity based on intrinsic characteristics of the vulnerability, independent of environment.
No exploitation activity has been observed at this time. Continue routine monitoring.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard