CVE-2021-22923

01/תיאור (מקור, אנגלית)

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

02/מוצרים מושפעים

haxx: curl; fedoraproject: fedora; netapp: cloud backup; netapp: clustered data ontap; netapp: hci management node; netapp: solidfire; oracle: mysql server; siemens: sinec infrastructure network services; netapp: h300s firmware; netapp: h300s; netapp: h500s firmware; netapp: h500s; netapp: h700s firmware; netapp: h700s; netapp: h300e firmware

03/קישורים10

• cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• hackerone.com/reports/1213181 ExploitIssue TrackingThird Party Advisory
• hackerone.com/reports/1213181 ExploitIssue TrackingThird Party Advisory
• lists.fedoraproject.org/archives/list/package-announce%40lists‮… Mailing ListThird Party Advisory
• security.gentoo.org/glsa/202212-01 Third Party Advisory
• security.netapp.com/advisory/ntap-20210902-0003/ Third Party Advisory
• lists.fedoraproject.org/archives/list/package-announce%40lists‮… Mailing ListThird Party Advisory