CVE-2021-22876

Description

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

CVSS breakdown

Affected products

• Broadcom / fabric_operating_system
• Debian / debian_linux9.0 – 9.0
• fedoraproject / fedora32 – 32
• fedoraproject / fedora33 – 33
• fedoraproject / fedora34 – 34
• haxx / libcurl7.1.1 – 7.75.0
• NetApp / hci_compute_node
• NetApp / hci_management_node
• NetApp / hci_storage_node
• NetApp / solidfire
• oracle / communications_billing_and_revenue_management12.0.0.3.0 – 12.0.0.3.0
• oracle / essbase21.2 – 21.2
• Siemens / sinec_infrastructure_network_services1.0.1.1
• Splunk / Universal Forwarder8.2.0 – 8.2.12
• Splunk / Universal Forwarder9.1.0 – 9.1.0

References

• MISChttps://hackerone.com/reports/1101882
• MISChttps://curl.se/docs/CVE-2021-22876.html
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC/
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ/
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2021/05/msg00019.html
• MISChttps://security.gentoo.org/glsa/202105-36
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• MISChttps://security.netapp.com/advisory/ntap-20210521-0007/
• MISChttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf