CURL-CVE-2021-22922
- Source
- https://curl.se/docs/CVE-2021-22922.html
- Import Source
- https://curl.se/docs/CURL-CVE-2021-22922.json
- JSON Data
- https://api.osv.dev/v1/vulns/CURL-CVE-2021-22922
- Aliases
- Published
- 2021-07-21T08:00:00Z
- Modified
- 2024-06-07T13:53:51Z
- Summary
- Wrong content via Metalink not discarded
- Details
-
When curl is instructed to download content using the Metalink feature, the contents is verified against a hash provided in the Metalink XML file.
The Metalink XML file points out to the client how to get the same content from a set of different URLs, potentially hosted by different servers and the client can then download the file from one or several of them. In a serial or parallel manner.
If one of the servers hosting the contents has been breached and the contents of the specific file on that server is replaced with a modified payload, curl should detect this when the hash of the file mismatches after a completed download. It should remove the contents and instead try getting the contents from another URL. This is not done, and instead such a hash mismatch is only mentioned in text and the potentially malicious content is kept in the file on disk.
There is a risk the user does not notice the message and instead assumes the file is fine.
- References
-
- Credits
-
-
- Harry Sintonen - FINDER
-
- Daniel Stenberg - REMEDIATION_DEVELOPER
-
Affected packages
Git / github.com/curl/curl.git
Affected ranges
- Type
- SEMVER
- Events
-
Introduced7.27.0Fixed7.78.0
- Type
- GIT
- Repo
- https://github.com/curl/curl.git
- Events